CIDR FACILITY OF UIDAI AS PROTECTED SYSTEM

## Policy Analysis Report: Declaration of UIDAI Computer Resources as Protected Systems **1. Executive Summary:** This report analyzes a notification issued by the Ministry of Electronics and Information Technology, Government of India, dated April 13, 2022. This notification declares specific computer resources of the Central Identities Data Repository of the Unique Identification Authority of India (UIDAI) and its associated facilities and information assets as "protected systems" under Section 70 of the Information Technology Act, 2000. The core purpose of this declaration is to enhance the security and protection of critical infrastructure and data related to the Aadhaar system. Key findings indicate a focus on securing data centers, security and network operation centers, cyber forensic capabilities, and logistical infrastructure associated with UIDAI. The report details the specifics of these protected resources, the likely rationale, and the expected impact of this declaration. The notification supersedes an earlier notification from 2015. Thus, this report is treating it as an amendment, even though it could be perceived as a "re-issuance." **2. Introduction:** This report aims to provide a comprehensive analysis of the notification issued by the Ministry of Electronics and Information Technology on April 13, 2022, regarding the declaration of specific UIDAI computer resources as protected systems. The analysis is based solely on the information provided in the given policy text. **3. Policy Overview:** * **Amendment:** This notification supersedes the previous notification G.S.R. 993E, dated December 11, 2015 (published December 21, 2015), issued by the Ministry of Communications and Information Technology. * **Core Objective(s):** The core objective, inferred from the text, is to enhance the security of the Central Identities Data Repository of UIDAI by designating specific computer resources as "protected systems" under the Information Technology Act, 2000. This aims to prevent unauthorized access, use, modification, or disruption of these critical assets. **4. Background and Rationale:** This notification is effectively an amendment or re-issuance of a previous policy. The likely reason for superseding the 2015 notification, inferred from the text, is to update the list of protected systems and facilities to reflect changes in UIDAI's infrastructure, technology, or security needs since 2015. The original need likely stemmed from the requirement to provide a secure IT environment for Aadhaar data and operations under the IT Act, 2000. The update probably addresses evolving cyber threats and expands the scope of protection to cover more of UIDAI's critical assets. **5. Key Provisions / Changes:** This notification supersedes the 2015 notification. The main change is the updated list of UIDAI's computer resources now designated as protected systems. The changes are as follows: * **What specific part of the original policy is being changed:** The entire list of "protected systems" is being updated. * **What the *new* rule/provision *is*:** The *new* rule is the designation of the *following* specific computer resources of the Central Identities Data Repository of UIDAI as "protected systems" : 1. Bangalore Hebbal Data Centre HDC 2. Security Operations Centre of HDC 3. Network Operations Centre of HDC 4. Manesar Data Centre MDC 5. Security Operations Centre of MDC 6. Network Operations Centre of MDC 7. UIDAI Headquarters Security Operations Centre 8. Information Security Division and Enforcement Wings of UIDAI Head Quarter 9. Cyber Forensic Laboratory at UIDAI Head Quarter 10. Logistics Infrastructure and Dependencies installed at UIDAI * **Explain the *difference* or the *effect* of this specific change:** The effect of this change is that the identified systems now fall under the enhanced protection measures provided for "protected systems" under the IT Act, 2000. The previous list, established in the 2015 notification, is no longer in effect, with these changes now superseding them. Although the original list is not provided, based on the updated list it is safe to say that there are new additions to the list of protected systems. **6. Target Audience and Stakeholders:** The primary target audience and stakeholders affected by this policy include: * **UIDAI:** As the agency responsible for the Central Identities Data Repository. * **Personnel responsible for managing and securing the listed computer resources:** This includes IT administrators, security professionals, and operations staff working at the data centers, security operation centers, and UIDAI headquarters. * **Ministry of Electronics and Information Technology (MeitY):** As the issuing authority and regulator for cybersecurity. * **Law enforcement agencies:** Responsible for investigating and prosecuting cybercrimes related to protected systems. * **Aadhaar holders:** Whose data security is indirectly enhanced by this policy. **7. Implementation Aspects (Inferred):** Based on the text, the following can be inferred about implementation: * **Responsible agency/bodies:** The UIDAI is responsible for implementing the measures to protect the designated systems. MeitY has oversight through its regulatory authority. * **Timelines or procedures:** The notification is effective immediately upon publication. Further procedures for implementing security measures are not specified in the text but would likely be guided by existing cybersecurity frameworks and best practices. * **(If Amendment):** The change (updating the list of protected systems) requires immediate action by UIDAI to implement necessary protection measures for the newly added facilities. This may involve updating security protocols, access controls, and incident response plans to specifically address the systems now designated as "protected." They also need to ensure compliance to the changed list, no longer being compliant to the previous list of protected systems. **8. Expected Outcomes / Impact of Changes:** The likely intended outcome of these changes is: * Enhanced security posture for UIDAI's critical infrastructure. * Reduced risk of cyberattacks and data breaches affecting Aadhaar data. * Improved compliance with legal and regulatory requirements for data protection. * Increased public trust in the security and reliability of the Aadhaar system. * Strengthened cyber security posture of the nation's critical IT infrastructure. **9. Conclusion:** The notification declaring specific UIDAI computer resources as protected systems represents a significant step towards strengthening the security of the Aadhaar system. This action, by updating the list of protected systems, reinforces the government's commitment to safeguarding critical infrastructure and protecting citizen data. The enhanced security measures for these systems will likely contribute to a more resilient and secure digital ecosystem in India.

Key Entities Referenced