Delhi High Court Dismisses Challenge To CERT-IN’s Empanelment Procedure, Reiterates That Courts Ought Not Sit In Appeal Over Expert Decisions

Justice Subramonium Prasad of the Delhi High Court recently dismissed a litigant’s challenge to the procedure adopted by Indian Computer Emergency Response Team (CERT-IN) w.r.t. empanelment of cyber-security firms as IT security auditing organizations.

It was observed that, “…the process of empanelment adopted by the Respondents is extremely technical. The Court cannot be expected to sit on appeal over decisions taken by experts and substitute its own conclusion with one arrived at by the experts.”

The petitioner had approached the court stating that the evaluation process undertaken by CERT-IN for Practical Skills Tests held in 2020 and 2021 was completely arbitrary.

Its case was that CERT-IN had illegally included operating system related vulnerabilities in the 'Master List' (a list of vulnerabilities to be detected by IT Audit Organizations which forms the scope of the tests) prepared for tests conducted in 2020 and 2021, and the same did not form part of the scope of tests.

The petitioner argued that it was being unfairly overlooked, despite having been previously empanelled to provide services of auditing. It sought production of the Master List by CERT-IN, averring that the same would promote transparency and ensure there was no arbitrary action.

The respondents, on the other hand, contended that despite being provided 2 opportunities as per Engagement Rules, the petitioner failed to qualify the Online Practical Skills Test. Accordingly, it was debarred for 1 year as a “cool-off” period, in terms of the Rules.

Decision to withhold the Master List was defended by contending that test-beds are renewed every 3 years and disclosure of the Master List would lead to ineffective empanelment tests, as any person aware of the list will be able to qualify for the next step in the empanelment process.

Analyzing the material on record, the court said, “…there was no infirmity with the decision of the Respondent No.1 in not allowing a reevaluation of the report submitted by the Petitioner on 22.09.2020 given the procedure to provide two attempts to qualify in the Online Practical Skill Test”.

No fault was found with CERT-IN’s decision to withhold the Master List. Considering the relevance of the Master List for future empanelment procedure, insofar as future test-beds could include vulnerabilities from the current Master List, Justice Prasad noted,

“…by withholding the master list, Respondent No.1 is ensuring that the sanctity of the IT Operations of important ministries and the other public authorities is not interfered with… the Master List prepared by the Respondents is therefore an important document, not only for the purposes of the test, but also for the integrity of the IT Systems of the concerned organizations”.

Concluding that there was complete application of mind by CERT-IN, it was added,

“A perusal of the material on record does not disclose any favouritism…There is nothing on record to show that the marks have not been given on the basis of an objective criteria unless it is shown that the selection done by the expert body is biased, capricious, whimsical or arbitrary, Courts must not venture to sit on appeal on the decisions taken by experts…”

Given that the cool-off period of 1 year had already ended, and the court was of the view that the Master List ought not be produced, the petition was dismissed.

Mr. Tarang Gupta and Mr. Kartikeya Sharma, Advocates appeared for petitioner

Mr. Vikram Jetly, CGSC with Ms. Shreya Jetly, Advocates and Mr. Rajesh Suri, Law Officer appeared for respondents

Case Title: Trusted Info Systems Private Limited v. Indian Computer Emergency Response Team & Anr.

Citation: 2023 LiveLaw (Del) 1150

Click Here To Read/Download Judgment