Power grids, banks, hospitals, railways and elections now run on networks — so attacks on networks are attacks on the nation. This chapter covers the basics of cyber security that GS III expects, India’s legal and institutional framework, and the double-edged role of media and social networking sites in internal security.

What UPSC asks

Mains GS III: critical information infrastructure protection, cyber warfare and cyber terrorism, the adequacy of India’s cyber framework, misinformation and radicalisation through social media, and balancing regulation with free speech and privacy.
Prelims: sections of the IT Act (66A, 66F, 69A, 70A, 70B), Shreya Singhal (2015), CERT-In, NCIIPC, I4C, the Budapest Convention, and basic terms (ransomware, phishing, DDoS, zero-day).

Key sub-topics

Sub-topic	Anchor
Types of cyber threats	Malware, ransomware, phishing, DDoS, APTs, zero-day exploits
Legal framework	IT Act 2000 (amended 2008), IT Rules 2021, DPDP Act 2023, Telecommunications Act 2023
Institutions	CERT-In, NCIIPC, I4C, National Cyber Security Coordinator, Defence Cyber Agency
Policy	National Cyber Security Policy, 2013
Media and social networks	Misinformation, deepfakes, radicalisation, internet shutdowns (Anuradha Bhasin, 2020)
Global regimes	Budapest Convention (2001); UN cybercrime convention