Indian companies are increasingly providing all of these.

Because of concerns of companies and govern­ments that are considering outsourcing, Indian businesses are under great pressure to adopt best practices and provide security environments equivalent to that of their competitors. As a result,

Measures taken by companies include complying with international security standards, establishing security policies, making provisions for security spending in the IT budget, among others. Larger companies have dedicated teams responsible for ensuring security, employ latest technologies, conduct security training and awareness programs, and form specific policies for personnel and physical security.[6]

Indian companies tend to allocate between 5 per­cent and 15 percent of their budgets for security.[7]

Indian network security involves basic technol­ogies like antivirus and firewall software. In addi­tion, if client requirements warrant them, advanced technologies such as intrusion detection systems, encryption, authentication, and access controls are used. Physical security at many Indian companies includes multiple-level physical access control systems, 24-hour security guards, and clear desk and clear screen policies.[8] Because most companies believe attacks are generated internally, personnel security involves a three-pronged approach: employee screening with background checks, training, and a robust disciplinary process. In addition, some Indian companies also have continuity and disaster recovery plans. Many industry members also have efficient security mechanisms and policies in place.

Most leading companies have very robust security practices. However, smaller companies have the basic technologies and policies in place, but are constrained by return on investment as far as investing in security is concerned.[9]

In addition to private sector initiatives to become a trusted outsourcing center by using best practices and international security protocols, the Indian legislature is also attempting to make the country more attractive to potential clients. In 2000, the legislature passed the Information Tech­nology Act of 2000, which "covers only unautho­rized access and data theft from computers and networks, with a maximum penalty of about $220,000, and does not have specific provisions relating to privacy of data."[10] This fall, it is expected to take up legislation amending the 2000 Information Technology Act. The amendments will likely conform to the adequacy norms of the European Union's Data Protection Directive[11] as well as U.S. Safe Harbor[12] privacy principles.

The EU Data Protection Directive prevents the transfer of personal data to non-EU nations that have not been certified as having adequate privacy protections. This directive relies on comprehensive legislation that requires, for instance, the establish­ment of government data protection agencies and registration of databases with those agencies. Because the United States takes a more segmented approach to privacy protection-relying on a mix of legislation, regulation, and self-policing-it had to develop a means for U.S. companies to comply with the EU directive. U.S. companies that use this Safe Harbor program are not hampered in their European operations. The program, which was approved by the EU in 2000, allows U.S. compa­nies that enroll in the program to avoid delay in business dealings and prosecution under EU pri­vacy laws. The companies are deemed to meet EU privacy standards.[13] If the Indian legislative changes meet the EU standards, India will become an even more significant source of data processing, as information about citizens of the EU countries can then be processed in India.

In addition, the National Association of Soft­ware and Service Companies (NASSCOM), a major representative of software and service com­panies in India, has been advocating that Indian regulations should also meet U.S. industry specific requirements (e.g., the Health Insurance Portabil­ity and Accountability Act) as well as state laws. To improve the perception of security and the willing­ness to prosecute computer crimes, NASSCOM has also helped to establish designated cybercrime sections within police departments in which spe­cially trained investigators focus solely on com­puter crimes.

In the absence of a stronger protections regime, foreign outsourcing customers have had to incor­porate their privacy and data security require­ments into a legally binding contract with Indian vendors. Contracts with U.S. outsourcers fre­quently specify New York as the controlling juris­diction and require insurance, which is usually provided by a U.S. carrier. Contract remedies for breaches may be problematic, however, because determining an appropriate remedy or damage amount is frequently difficult.

The Next Steps

India's current laws regarding electronic com­merce, copyright and patent protection, identity theft, privacy, and cyberterrorism must be strengthened. Revising the Information Technol­ogy Act of 2000 must be a priority, but more also needs to be done.

As promising as the growth of the Indian BPO sector and the effort of IT companies to perform due diligence in protecting information and ensur­ing continuity of service has been, more needs to be done for India to fulfill its potential as a global economic and security partner. According to the Financial Times, direct foreign investment in India is "anaemic,"-$4 billion compared to $50 billion for China.[14] The lack of foreign investment has hamstrung India's efforts to expand and update its infrastructure, modernization that is critical to spurring further economic expansion. In large part, the lack of investment reflects the absence of reform in the Indian economy outside the IT sec­tor. According to the 2004 Index of Economic Free­dom, "the government continues to restrict 700 sectors to small-scale industries, preventing larger companies from taking advantage of economies of scale."[15] Trade barriers and excessive regulation discourage overseas private investment. Addition­ally, artificial barriers that keep U.S. goods and ser­vices out of Indian markets have slowed the growth of robust U.S.-Indian partnerships. India should adopt reforms to reduce government regu­lations and liberalize its protectionist trade polices to encourage more foreign investments. A wave of bold reforms on the part of India would do much to strengthen U.S.-Indian economic ties, undercut unwarranted criticisms about outsourcing, and reduce concerns about potential security risks from BPO activities.

In turn, the United States should put in place the right framework to take full advantage of opportunities offered by Indian BPO companies. In particular, Congress should facilitate a predict­able business environment that will ensure that overseas companies will not be unfairly discrimi­nated against based on unwarranted security con­cerns. For example, Congress should remove Section 835 "Prohibition on Contracts with Cor­porate Expatriates" from the Homeland Security Act.[16] DHS should have the power to award con­tracts to any company that can perform services effectively, efficiently, and securely. Meanwhile, DHS and other federal agencies that may wish to outsource homeland security work overseas should establish programs similar to the Depart­ment of Defense's National Industrial Security Pro­gram, in order to provide BPO companies with clear guidance about the requirements and stan­dards for performing security-related services.[17]

What the U.S. Government Should Do

India's efforts to become a "trusted provider" of IT services are laudable. They have established the foundation for mutually beneficial economic and security partnership, one that could serve as a model for U.S. cooperation with other developing nations. More must be done, however, to fully exploit the potential of U.S.-Indian cooperation. While India should continue its efforts to create a strong privacy regime for all information being processed within the country, the U.S. government should:

• Consider outsourcing data processing where possible, but also be careful to choose compa­nies (and countries) that will provide the most security value for the money spent;
• Outsource data processing where appropriate, but ensure that the BPO vendor and the coun­try meet stringent privacy standards; and
• Eliminate regulatory barriers that impose unwarranted prohibitions against outsourcing.

Conclusion

The goal of increasing domestic security and protecting the privacy of U.S. citizens should not be an obstacle to strengthening economic ties with the developing world. Rather, market forces and sensible outsourcing can be used both to promote better global security practices and to encourage economic growth.

James Jay Carafano, Ph.D., is Senior Research Fellow for National Security and Homeland Security in the Kathryn and Shelby Cullom Davis Institute for International Studies at The Heritage Foundation. Paul Rosenzweig is Senior Legal Research Fellow in the Cen­ter for Legal and Judicial Studies at The Heritage Foun­dation and Adjunct Professor of Law at George Mason University. Alane Kochems, a research assistant at The Heritage Foundation, contributed to this paper.