Greetings,

These are the definitions and proposed clauses we submitted in response to the public consultation issued by the Communications and Information Technology Regulatory Authority (CITRA).

Submitted by: Abdullah Al-Mutairi.

Phone: 60703742

Email: team@aindot.com

Website and social identifiers:

https://aindot.com | https://x.com/aindotit | https://instagram.com/aindotit

Definitions

Latency-sensitive applications: Applications that require a very low response time to operate efficiently, such as banking transactions, internet calls, video conferences, digital gaming, internet-connected medical devices, and system control protocols. ¹

Instant traffic: Prioritizing instant network traffic through a configured and announced, commonly known, or specifically designated port or network domain address. ²

Public Static IP service: A fixed internet address assigned and directed to a specific customer upon their request. ³

Unlock Code: A serial code used to remove the network lock from an internet access device so that it becomes usable with any other service provider.

Unlocking portable wireless devices: The act of unlocking phones and tablets that have been software-locked so that they refuse connectivity with another service provider’s network. ⁴

Acceptable response time for incoming requests: The defined period within which a company licensed by the General Authority for Telecommunications must respond to requests, complaints, or inquiries received from customers.

Internal reference number: A text composed of several unique characters or numbers, automatically assigned within the service provider’s internal system, used to track, manage, and document all procedures related to a customer’s request.

Flash short messages: Short messages that appear immediately on the phone screen without being stored in the inbox and disappear once dismissed. ⁵

Query short messages, or silent short messages: Messages sent to a subscriber of a telecommunications service without being displayed on the phone screen or saved in the received-messages log, with the query confirmation returned to the sending party. ⁶

Self-service: A mechanism allowing the customer to view and manage their account or subscription with the service provider directly through a digital website, a digital application, or any other automated means of communication.

Internet of Things (IoT) devices: Physical devices embedding sensory, visual, wireless, or any other sensors capable of measuring the surrounding environment, and also capable of processing and exchanging data, whether over the internet or any other communication medium.

Intellectual Property Protection Law: Law No. 75 of 2019 on Copyright and Neighboring Rights. ⁷

Official communication channels: The approved means of communicating with customers.

Auto-reply: An immediate reply sent automatically upon receipt of a message on an approved communication channel, confirming receipt of the message or request.

Auto-reply by email: An immediate automated reply sent in response to an incoming message at the announced email address dedicated to receiving requests, inquiries, or complaints, issued from a no-reply email address.

Application Programming Interface (API): A means allowing systems and applications to communicate and exchange data with the service provider’s systems securely and in an organized manner. ⁸

Direct contact form: A digital contact form on the service provider’s website allowing a subscriber, customer, or visitor to communicate directly with the company.

Privacy policy: An official published document explaining how personal data is collected and processed.

Terms of service policy: An official published document setting out the relationship between the company and the user, and the rights and obligations of each party.

Request For Comment (RFC) document: A formal technical document issued by the Internet Engineering Task Force (IETF) defining standards, protocols, and best practices for the internet and telecommunications. ⁹

Inbound Port: Ports that receive connections coming from the internet to the device or server.

Outbound Port: Ports used by the device or server to connect and send data externally to the internet.

SMTP email protocol: The standard for email transfer and delivery, applied on inbound port 25 and outbound port 25 over TCP and UDP. ¹⁰

Global spam blocklists: Public databases containing internet addresses or domains known for sending unwanted spam. ¹¹

Site root: The main directory on a web server.

well-known folder: A folder located at the site root, accessible without authorization, used to publish general technical information or response methods for automated systems. ^{12 13}

Reasonable response window: The reasonable period to respond to incoming requests, whether automatically or when escalated to human review.

Official means of evidence: Law No. 39 of 1980 on Evidence in Civil and Commercial Matters, and Law No. 20 of 2014 on Electronic Transactions. ^{14 15}

Alert (Notification): A warning received or sent directly to the concerned party by the service provider, the company, or its delegate, through official means of evidence.

Notice: A warning received or sent to the concerned party automatically through official communication channels, provided that the notice dispatch period does not exceed 24 hours.

IPv4 and IPv6 address registries held by the service provider: The IPv4 and IPv6 addresses and number extensions owned by the telecommunications service provider company and under its disposal and management.

Clauses

Information Security

• Telecommunications and information technology service providers shall be committed to enforcing and monitoring the RFC 9116 standard concerning the placement of a security.txt file under the well-known folder of the site root. ¹⁶

• Telecommunications and information technology service providers shall activate an abuse email address to receive local, Gulf, or international complaints regarding problems that may occur on, or originate from, their network. The address must include an auto-reply confirming receipt of the request and a reply policy clearly stated in Arabic and English, and the auto-reply must contain an address capable of receiving follow-up replies or include a reply-to option.

• Telecommunications and information technology service providers shall handle reports received at the abuse mailbox seriously and professionally, as it constitutes a front door to the State of Kuwait.

• When handling fraud and phishing reports, telecommunications and information technology service providers shall receive the report seriously and pass it to the relevant entity or take direct action regarding the fraud or impersonation incident.

• Telecommunications and information technology service providers shall pass on information-security messages sent to them by a third party to the relevant customer, without disclosing the customer’s personal data to any third party except under a legal justification.

• Messages forwarded to the customer must include the following:

  • How the forwarded message was created.
  • All data contained in the third party’s message, including their contact details.
  • A clear statement in the message sent to the customer reading: “No need to reply to this message.”

• Telecommunications and information technology service providers shall immediately and transparently disclose any breach or security incident related to information security that affects subscriber data within 72 hours, and the disclosure shall include:

  • How the breach occurred.
  • The root cause.
  • The type of affected data and the scope of impact.

Communication Channels and Self-Service for Internet and Other Services

• Telecommunications and information technology service providers shall provide an effective self-service for customers, including at a minimum:

  • Automated replies via a digital assistant serving the subscriber, enabling them to subscribe to or cancel basic services, track requests, pay invoices, and request the import of a log of the last 6 operations performed on the subscriber’s account.
  • A digital portal through the website serving the subscriber, enabling them to subscribe to or cancel basic services, track requests, pay invoices, request the import of the subscriber’s complete record held by the company or service provider, view all services and numbers registered on the subscriber’s account as well as sub-accounts registered on it, in addition to the ability to download and view the subscriber’s Access Log. ¹⁷

• Telecommunications and information technology service providers shall provide a known, announced support email address for receiving requests, with an auto-reply confirming receipt of the request and stating the reply policy.

• Telecommunications and information technology service providers shall provide known, announced email contact addresses for receiving requests, complaints, general inquiries or otherwise, with an auto-reply confirming receipt and a reply policy clearly stated in Arabic and English, and the auto-reply must contain an address capable of receiving the customer’s replies or include a reply-to option. ¹⁸

Notifications

• Telecommunications and information technology service providers shall notify the customer of any viewing of, or access to, their personal data by any internal or external entity other than the service provider and for non-technical purposes. This includes viewing for administrative or legal purposes, or self-access via the subscriber’s own self-service.
  • Telecommunications and information technology service providers shall keep a dedicated record of access operations to the customer’s personal data (Access Log) including: viewing date, time, the identity of the entity or employee, source IP address, the purpose of viewing, and the request or permission number.
  • Access logs shall be retained for a period of no less than two years.

Quality of Service (QoS) Assurance for Latency-Sensitive Internet Applications

• Telecommunications and information technology service providers shall provide special treatment to assure Quality of Service (QoS) for latency-sensitive services and applications without degrading network quality for either download or upload. These applications include, without limitation:

  • Voice over IP telephony services.
  • Remote meetings.
  • Digital gaming.
  • Connected medical equipment and devices.
  • Server control and connection tools and release-management tools.
  • Digital financial transactions.

• Telecommunications and information technology service providers shall disclose and publish their traffic management policy ¹⁹ and the special treatment of latency-sensitive applications, including the service name, description, port or domain, and protocol.

• The service provider may treat a latency-sensitive application like any other connection if:

  • The connection speed directly exceeds 30Mbps on the port configured for, or the domain specific to, the latency-sensitive application. ^{20 21 22}

Internet Services and Supplementary Internet Services

• Private internet access telecommunications and information technology service providers may not block any outbound or inbound port.

• Private internet access telecommunications and information technology service providers must block only the outbound port of the SMTP email protocol, to safeguard the reputation of the State of Kuwait’s internet addresses.

• If a customer wishes to request the removal of the SMTP outbound port block, they must submit a formal request to the service provider with justifications. The service provider may define conditions and restrictions, for example: limits on volume and data quantity, restrictions on destinations, or the activation of an additional authentication mechanism, as it sees fit to preserve network integrity and internet address quality.

• Providing persons with VPN private-network connectivity services to a third party outside the State of Kuwait is prohibited, as is selling and promoting such a service using the internet addresses of companies and telecommunications and information technology service providers operating and registered in the State of Kuwait.

• Subscribers or customers may request the Public Static IP service at a fixed monthly price.

  • The service provider may not impose boundaries or restrictions on the use of the service; for example, the provider may not block any inbound port into the customer’s network.
  • The customer is not required to be registered as a business account with the telecommunications and information technology service provider to request the service.
  • The service provider shall advise the subscriber to take appropriate security measures; the assignment and management of the firewall and security settings remains the customer’s own responsibility.

• Private internet access telecommunications and information technology service providers shall activate the IPv6 internet address protocol for all subscribers, residential or commercial.

Communication Devices and Locked Handsets

• The company shall provide the customer with the device unlock code within the reasonable response window in the following cases:
  • Full payment of the device price.
  • The end of the actual subscription period tied to the device, with the customer having paid the subscription in full.

Promotional Messages and Silent Messages

• The use of flash short messages for advertising or promoting services and products is prohibited.

• The use of query short messages, or silent short messages, for anything other than Internet of Things devices is prohibited.

Services Dedicated to Internet of Things (IoT) Devices

• Where a telecommunications and information technology service provider offers SIM cards dedicated to the Internet of Things, it shall comply with the following:

  • Provide a self-service screen allowing the customer to activate and deactivate the SIM cards.
  • Provide a self-service screen allowing the customer to set a consumption ceiling per SIM with an automatic cut-off option.
  • Provide an API allowing the customer to query and control the SIM cards.
  • Provide a fixed, published price per megabyte (MB) unit.

• SIM cards dedicated to the Internet of Things shall not be provisioned with voice numbers. Sending and receiving short messages shall be restricted to a closed internal network, and all messages sent and received shall appear exclusively on the self-service screen of each SIM card.

Transparency, Operating Environment and Community Service

• Telecommunications companies shall mark their towers with the company logo in a clear and visible manner.

• Telecommunications and information technology service providers shall cooperate with the Public Authority for Environment and the Kuwait Municipality to provide a safe mechanism for receiving and recycling electronic waste and batteries, as a community service.

• Telecommunications companies shall, upon the customer’s request — directly or through self-service — to register a dedicated email address, send notices concerning the expected status and duration of periodic maintenance of towers or services related to the customer’s subscription.

• Telecommunications and information technology companies providing internet services are mandatorily required to periodically and immediately update the IPv4 and IPv6 address registries registered in the company’s name or under its direct management. ^{23 24 25}

Providing Open-Source Software Mirrors

• Internet-service telecommunications and information technology providers shall operate their own mirror sites with high-speed connectivity for the most important commonly used open-source software and non-profit projects (such as Linux distributions, development tools, open databases, and others).

• These mirrors must be publicly available inside Kuwait at high download speed, and their links shall be clearly advertised on the company’s official website. ²⁶

• A fixed internet domain address shall be dedicated to these mirrors, with direct access allowed over the internet protocol.

• The service provider company may restrict or downgrade connectivity for any internet address outside the State of Kuwait.

Intellectual Property Protection

• Telecommunications and information technology service providers subject to this regulation shall respect intellectual property laws, refrain from trading in pirated software, and prohibit the use of local and private networks in activities that pirate content and intellectual property.

References

Footnotes

1. Adapted from, Quality of Service Regulation Manual, 2017 http://handle.itu.int/11.1002/pub/8108e11f-en. ↩

2. Determining your QoS requirements, https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/67342/determining-your-qos-requirements ↩

3. https://web.archive.org/web/20200518081410/https://www.kw.zain.com/en/net-add-ons ↩

4. Adapted from, CTIA, Consumer Code for Wireless Services, https://www.ctia.org/the-wireless-industry/industry-commitments/consumer-code-for-wireless-service, document: https://api.ctia.org/wp-content/uploads/2020/03/CTIA-Consumer-Code-2020.pdf ↩

5. These are Class 0 messages, GSM/3GPP Standards (class 0 SMS), Flash SMS or as known. https://ozeki-sms-gateway.com/p_3640-class-0-sms.html ↩

6. Known as Ping SMS / Stealth SMS. https://ozeki-sms-gateway.com/p_3641-stealth-sms.html and https://ozeki-sms-gateway.com/p_3642-ping-sms.html ↩

7. Kuwait National Library, https://www.nlk.gov.kw/Upload/Bibligra/newlaw8152019103201AM.pdf ↩

8. Rest API https://www.redhat.com/en/topics/api/what-is-a-rest-api, GSMA Open Gateway https://www.gsma.com/solutions-and-impact/gsma-open-gateway/gsma-open-gateway-api-descriptions/ ↩

9. About RFCs, https://www.ietf.org/process/rfcs/ ↩

10. Service Name and Transport Protocol Port Number Registry, SMTP service https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=smtp ↩

11. Spamhaus project, https://www.spamhaus.org/ ↩

12. Well-Known Uniform Resource Identifiers (URIs), https://datatracker.ietf.org/doc/html/rfc8615 ↩

13. Well-Known URIs, https://www.iana.org/assignments/well-known-uris/well-known-uris.xhtml ↩

14. Legislation and Laws, Ministry of Justice https://www.moj.gov.kw/AR/Pages/MojLaws.aspx , direct link ↩

15. Legislation and Laws, Kuwait Portal https://e.gov.kw/sites/kgoArabic/Pages/Business/InfoSubPages/LawsAndRegulations.aspx , direct link: https://e.gov.kw/sites/kgoArabic/Forms/MagazineA.pdf ↩

16. A File Format to Aid in Security Vulnerability Disclosure, https://datatracker.ietf.org/doc/html/rfc9116 ↩

17. For example, accounts of minors, or company accounts owned by the customer or for which they are the legal representative before the service provider. ↩

18. Sending emails from your service, https://www.gov.uk/service-manual/technology/how-to-email-your-users ↩

19. Traffic Management Policy ↩

20. 25Mbps 4K streaming https://support.tcl.com/rokutv-common-questions/1-whats-the-minimum-bandwidth-requirement-to-stream-4k-content ↩

21. What internet speed is required for professional Twitch streaming? https://www.business.att.com/resources/knowledge-center/what-internet-speed-is-best-for-esport-streaming.html#whatSpeed ↩

22. Broadband Speed Guide, FCC https://www.fcc.gov/consumers/guides/broadband-speed-guide ↩

23. IX.KW Looking Glass https://lg.ix.kw/ ↩

24. PeeringDB https://www.peeringdb.com/ ↩

25. ASN Number, example: https://bgp.he.net/AS42961 ↩

26. Maen Network, https://mirror.maeen.sa/ ↩