file photo
NEW DELHI: While the govt is firm that department of telecommunications’ (DoT) Nov 28 direction mandating continuous SIM-binding of messaging apps like WhatsApp is a critical security intervention to check cyber crime and misuse of the apps by foreign intelligence agencies to exfiltrate information from India without traceability, there are indications that it may be open to raising six-hour auto-logout limit for web sessions.The six-hour auto-logout norm – which many messaging apps are resisting on ground that “logging every 6 hours would cause unacceptable inconvenience” – is exclusive to web or desktop versions of the messaging apps.According to DoT directions, the web service instance of mobile apps must log out periodically not later than six hours, allowing users to relink devices via QR code. “This specifically targets the long session vulnerability used in cross-border scams, forcing periodic re-authentication that proves control of the device and SIM. Most banking and UPI apps successfully use this auto-logout security feature,” said an official.Also, the argument of messaging apps that SIM binding will force users to buy international roaming services from Indian telecom service providers every time they travel abroad, seems rather flimsy considering the same users are willing to spend liberally on airline tickets and hotels abroad, said an officer.Govt sources said the six-hour auto logout limit for web versions can be revisited and raised to 12 or 18 hours, but not beyond 24 hours. A third objection – that DoT cannot issue directions to apps like WhatsApp as they are covered under the IT Act – is also weak as these apps are hosted on mobile networks run by the telecom service providers who are also the primary Internet service providers.With cyber fraud losses having exceeded Rs 22,800 crore in 2024 and some defrauded persons being driven to suicide, govt agencies are unanimous that DoT directions are “proportionate measures to prevent misuse of telecom identifiers, ensure traceability & protect citizens’ trust in India’s digital eco-system”.Officials said the DOT direction followed warnings from security establishment, with National Security Council Secretariat having raised the issue in Dec 2024 along with directions to DoT to study SIM-binding requirements for instant messaging applications.MHA formed a technical sub-group in Sept 2024 comprising members from DoT, Delhi Police, MHA, MeitY, IB and TRAI, which recommended binding social media and OTT services to mobile numbers. In April 2025, MHA directed IT intermediaries to implement the technical measures including SIM binding and geo-fencing for communication apps like WhatsApp, to mitigate cybercrime threats.”DoT field units too independently echoed these concerns with law enforcement agencies. Also, cellular operators association of India requested SIM binding implementation in Aug 2025, to surb cross-border frauds and ensure national security,” a security official told TOI Saturday.
