Starlink and lawful interception

Starlink, an innovative data communications provider, was granted a s. 17 license under the Sri Lanka Telecommunications Act in 2024. The first thing to note about licenses of this type are that they are intended to give certainty to licensors.

In the modern context, a license is a legal instrument that sets out the rights and obligations of both the licensee and the licensor, who also represents the interests of the public at large. License conditions which reflect public-policy objectives embody the obligations of the licensees to provide specified benefits, while minimizing harm. The violation of license conditions should carry consequences. By defining the powers of the licensor to modify, renew or not renew a license and to enforce license conditions and by setting out procedures for those actions, the legal instrument provides certainty and reduces the risks of investment, thereby providing a benefit to licensee operators/providers. License conditions may be modified, but only by following proper procedure. Unilateral modification creates uncertainty and gives a wrong signal to investors.

News reports claim that the Starlink license does not include provisions on lawful interception. Not having read the license (which should be on the TRC website, but is not), I am unable to confirm this. There is no consistent practice of including lawful interception conditions in licenses. The SLT license includes such a condition (not included in the original license issued in the early 1990s) but the Mobitel license does not. Both were issued in 2023. Starlink is sui generis, but if one is looking for similarities, it is closer to a mobile operator (Mobitel) than to a fixed operator (SLT). Without going through the drama of license modification, government may be better served by quiet negotiation.

When the exchange or gateway is located inside a country, it is possible (but not routine) to install the software necessary to record certain communications and provide those records to law enforcement authorities (this is what lawful interception means). This is a serious violation of privacy expectations of customers. Conditions that require operators to maintain privacy and confidentiality, other than in circumstances set out in the Telecom Act and other legislation are set out in all licenses (possibly also in the Starlink license). Usually, action under these exceptions requires court orders.

In the case of Starlink, the gateway is not located in Sri Lanka. It is likely that messages from multiple countries are processed together. This will make the installation of lawful interception software somewhat complicated.

The security implications of Starlink being allowed to operate in India, a much larger and more lucrative market and one which has greater security concerns, are under discussion (https://www.newindianexpress.com/business/2025/Mar/16/starlinks-india-debut-the-back-story). Here, the issues are “using satellites for authorized services only and providing call data records to security agencies when requested. The company will also need to establish a buffer zone along India's international borders and ensure that all calls originating or terminating in India pass through a GMPCS Gateway within the country.” Once an India-specific gateway is established within the country, it may be possible to go beyond the supply of call-detail records to security agencies.

Sri Lanka being a very small market, it is unlikely that the Telecom Regulatory Commission and the Minister have the kind of leverage that their Indian counterparts have. The end result of the current process may therefore be the withdrawal of Starlink from Sri Lanka and/or getting Sri Lanka on the Trump Administration’s radar as a country that is taking punitive measures against an American company.

Rohan Samarajiva is founding Chair of LIRNEasia, an ICT policy and regulation think tank active across emerging Asia.