Cyber Security: Threats, Institutions and Policy

Why cyber security matters

India has over 95 crore internet subscribers and the world's largest real-time payments system (UPI). Its Digital Public Infrastructure (Aadhaar, UPI, DigiLocker, CoWIN, ONDC) is also expanding. This makes cyber space a critical domain of national security, alongside land, sea, air and space.

Rising incidents: CERT-In handled over 13 lakh incidents in 2022 and higher numbers since. Cyber financial fraud reported on the 1930 helpline and the National Cyber Crime Reporting Portal runs into thousands of crores a year. Figures vary by year, so cite them as indicative.

Types of cyber threats

• Malware: viruses, worms, trojans and spyware. Ransomware encrypts data and demands payment, as in the AIIMS Delhi attack (November 2022).
• Phishing and social engineering, including "digital arrest" scams in which fraudsters impersonate police or CBI on video calls. The Prime Minister warned about these in 2024.
• DDoS (distributed denial of service) attacks.
• Advanced Persistent Threats (APTs): long-term state-backed intrusions. An example is the reported Chinese-linked targeting of India's power grid (RedEcho, 2020–21), linked by some analysts to the Mumbai outage of October 2020.
• Data breaches: leaks of personal data from health, telecom and other databases.
• Cyber espionage, cyber terrorism and cyber warfare: attacks on critical information infrastructure (CII) such as power, banking, telecom and transport.
• Supply chain attacks: compromised hardware or software, such as Chinese telecom equipment and apps. This led to app bans (2020) and trusted-source rules for telecom.
• Deepfakes and AI-enabled fraud; crypto-based laundering; dark web markets.
• Mule accounts and SIM-box frauds, many run from scam compounds in Southeast Asia (Myanmar, Cambodia, Laos) that use trafficked Indians.

Legal framework

Information Technology Act 2000 (amended 2008):

• Section 43 covers civil liability;
• Section 66 covers hacking and identity theft, 66F cyber terrorism (punishable with life imprisonment), and 67 obscene content;
• Section 69 allows interception and 69A blocking of content;
• Section 70 declares protected systems (CII);
• Section 70A creates the NCIIPC;
• Section 70B makes CERT-In the national nodal agency;
• Section 79 gives intermediary safe harbour.

Section 66A was struck down in Shreya Singhal v. Union of India (2015) as violating free speech.

Other laws and rules:

• IT Rules 2021: intermediary due diligence, grievance officers, a traceability requirement for significant messaging intermediaries (challenged in court), and a digital media ethics code;
• CERT-In directions (April 2022): report incidents within 6 hours, keep logs for 180 days, and VPN providers must keep customer data;
• Digital Personal Data Protection Act 2023, with Rules notified in 2025 and phased implementation; the Data Protection Board;
• Telecommunications Act 2023: interception, SIM verification and security;
• Bharatiya Nyaya Sanhita 2023: organised crime, including cyber crimes.

Institutional framework

• CERT-In (Indian Computer Emergency Response Team, MeitY): the national incident response agency, with sectoral CERTs (finance, power).
• NCIIPC (National Critical Information Infrastructure Protection Centre): under NTRO, it protects CII.
• National Cyber Security Coordinator: in the National Security Council Secretariat.
• Indian Cyber Crime Coordination Centre (I4C): under the MHA (2018). It runs the National Cyber Crime Reporting Portal (cybercrime.gov.in), the 1930 helpline and the Citizen Financial Cyber Fraud Reporting and Management System, and blocks fraud SIMs and IMEIs. It became an attached office in 2024.
• Defence Cyber Agency (2019): a tri-service agency.
• Cyber Swachhta Kendra: a botnet cleaning and malware analysis centre.
• Cyber Surakshit Bharat: training for CISOs.
• Sanchar Saathi portal (DoT): to block lost phones and report suspicious connections and calls (Chakshu).

Policy

National Cyber Security Policy (2013):

• create a workforce of 5 lakh cyber professionals;
• 24×7 NCIIPC;
• secure e-governance.

A new National Cyber Security Strategy has been drafted but not yet released. This is a commonly cited gap.

International dimension

• Budapest Convention (2001): the main international treaty on cybercrime. India has not joined. It objects that it was drafted without India's participation and to its provisions on cross-border data access.
• UN Convention against Cybercrime: adopted by the UN General Assembly in December 2024, opened for signature in 2025. India took part in the negotiations; verify its status.
• UN Open-Ended Working Group on ICT security; norms of responsible state behaviour.
• Quad cyber security partnership; bilateral cyber dialogues.
• Counter Ransomware Initiative, which India joined.

Challenges

• Shortage of skilled professionals.
• Import dependence for hardware and software.
• Fragmented institutional structure, with many agencies and weak coordination.
• Low cyber hygiene among users, MSMEs and government departments.
• Jurisdiction: servers and criminals sit abroad, and MLAT processes are slow.
• Encryption versus lawful access.
• Police capacity at the state level: policing is a State subject.

Way forward

• Release the national cyber security strategy and create a single coordinating authority.
• Hold regular audits of CII.
• Develop indigenous hardware (semiconductors) and trusted supply chains.
• Expand cyber forensics labs and train police.
• Pass a dedicated cyber security law.
• Raise public awareness in regional languages.
• Strengthen international cooperation through faster data-sharing agreements.
• Build cyber insurance markets.

Common prelims traps

• CERT-In is under MeitY; NCIIPC is under NTRO; I4C is under the MHA.
• Section 66A was struck down in 2015 (Shreya Singhal).
• India has not signed the Budapest Convention.
• Under the CERT-In directions, incidents must be reported within 6 hours.

Quick self-test

1. *What is Critical Information Infrastructure?* Computer resources whose incapacitation would have a debilitating impact on national security, the economy or public health and safety.
2. *What is a "digital arrest" scam?* Fraudsters posing as police on video call, falsely claiming the victim is under investigation and extorting money. There is no such legal procedure.
3. *Why does India not join the Budapest Convention?* It was not involved in drafting it, and has sovereignty concerns about cross-border data access.

Practice: Mains question

*"India's cyber security architecture is fragmented and reactive." Critically analyse and suggest measures to secure critical information infrastructure. (250 words)*

Key terms

• Zero-day: a software vulnerability unknown to the vendor, with no patch available. It is highly valuable to attackers.
• Botnet: a network of infected devices controlled remotely, used for DDoS attacks and spam.
• Air gap: physically isolating a critical system from the internet, common in nuclear and defence networks.
• Zero trust: a security model in which no user or device is trusted by default, even inside the network.
• Cyber hygiene: basic practices such as strong passwords, two-factor authentication, updates and backups.

Analysis: securing the financial and digital public infrastructure

India's DPI processes billions of transactions a month, so its resilience is vital. The RBI's cyber security frameworks for banks, NPCI's fraud-risk monitoring and SEBI's Cyber Security and Cyber Resilience Framework (2024) show sector regulators taking the lead.

Fraud continues to grow, however, through mule accounts and social engineering. The RBI's MuleHunter.AI tool and the Digital Intelligence Platform of the DoT are recent responses.

The human factor remains the weakest link: most successful attacks begin with a click. Mass awareness campaigns, cyber safety in school curricula and simple reporting channels are therefore as important as firewalls.

Practice: additional question

*Discuss the challenges posed by deepfakes to internal security and democratic processes in India. (150 words)*