Cyber Security: Threats, Laws and Institutions
UPSC GS III notes on cyber threats, the IT Act 2000 and its key sections, CERT-In, NCIIPC, I4C, the DPDP Act 2023, and social media's role in internal security.
SyllabusGS III · Challenges through communication networks, role of media and social networking sites, basics of cyber security
Prerequisites: Cyber Security — overview · IT, Computers and Emerging Technologies
The Hook: When a Hospital Went Offline
In November 2022, a ransomware attack crippled the servers of the All India Institute of Medical Sciences (AIIMS), New Delhi. For about two weeks, one of the country’s busiest hospitals fell back on manual registration and paper records.
No bomb, no border crossing — yet a critical public service stopped. The episode raised the question this chapter answers: who in India is responsible for defending networks, under which law, and is that framework enough?
The Core Concept
Basics: what cyber security protects
Cyber security protects the confidentiality, integrity and availability of information and systems (the “CIA triad”).
| Threat | What it does | Example to cite |
|---|---|---|
| Malware | Malicious software — viruses, worms, trojans, spyware | Stuxnet (discovered 2010), a worm that damaged Iranian nuclear centrifuges — the first widely known cyber weapon against physical infrastructure |
| Ransomware | Encrypts data and demands payment to unlock it | WannaCry (May 2017, global); AIIMS Delhi (November 2022) |
| Phishing / social engineering | Tricks users into revealing credentials or installing malware | Fake bank or courier messages; “digital arrest” scams |
| DDoS (distributed denial of service) | Floods a server with traffic from many hijacked machines (a botnet) | Attacks on government and bank websites |
| Advanced Persistent Threat (APT) | Long-term, stealthy intrusion, often State-backed, for espionage | Targeting of power, defence and government networks |
| Zero-day exploit | Uses a software flaw unknown to the vendor, so no patch exists | Sold on grey markets; used in spyware |
| Cyber terrorism / cyber warfare | Attacks intended to threaten the State’s unity, security or sovereignty | Defined as an offence under IT Act Section 66F |
Critical Information Infrastructure (CII) is a computer resource whose incapacity would have a debilitating impact on national security, the economy, public health or safety (Section 70 of the IT Act). Power grids, banking, telecom, transport and government networks are the obvious examples.
The legal framework
Information Technology Act, 2000 — India’s primary cyber law, based on the UNCITRAL Model Law on Electronic Commerce. It first gave legal recognition to electronic records and digital signatures; the 2008 amendment (in force from 2009) added most of the cyber-security provisions.
| Section | Provision |
|---|---|
| 43 | Civil liability (compensation) for damage to computer systems |
| 66 | Computer-related offences (hacking with dishonest or fraudulent intent) |
| 66A | Offensive messages through communication services — struck down in Shreya Singhal v. Union of India (2015) |
| 66C / 66D | Identity theft / cheating by personation using a computer |
| 66F | Cyber terrorism — punishable with imprisonment that may extend to life |
| 69 | Interception, monitoring and decryption of information on specified grounds |
| 69A | Blocking of public access to information (upheld in Shreya Singhal) |
| 70 | Declaration of “protected systems” (CII) |
| 70A | National nodal agency for CII protection — NCIIPC |
| 70B | National agency for incident response — CERT-In |
| 79 | “Safe harbour” for intermediaries that observe due diligence |
Other laws and rules
| Instrument | Year | Relevance |
|---|---|---|
| IT (Intermediary Guidelines and Digital Media Ethics Code) Rules | 2021 | Due diligence and grievance redressal by platforms; extra duties for “significant social media intermediaries”, including a Chief Compliance Officer, a Nodal Contact Person and a Resident Grievance Officer; identification of the “first originator” by messaging services in specified cases |
| CERT-In directions | April 2022 | Report specified cyber incidents within 6 hours; maintain ICT system logs for 180 days |
| Digital Personal Data Protection Act | 2023 | Consent-based processing of digital personal data; duties of data fiduciaries; Data Protection Board of India |
| Telecommunications Act | 2023 | Replaced the Indian Telegraph Act, 1885; provides for interception and suspension of services on specified grounds |
| Bharatiya Nyaya Sanhita / Bharatiya Sakshya Adhiniyam | 2023 | New criminal law and evidence law (in force July 2024), including treatment of electronic records |
The institutional framework
graph TD
A["National Security Council Secretariat: National Cyber Security Coordinator"] --> B["MeitY: CERT-In — incident response, Sec 70B"]
A --> C["NTRO: NCIIPC — critical infrastructure, Sec 70A"]
A --> D["MHA: I4C — cybercrime coordination"]
A --> E["Defence: Defence Cyber Agency"]
B --> F["Sectoral CERTs and Cyber Swachhta Kendra"]
D --> G["cybercrime.gov.in and helpline 1930"]| Body | Parent | Role |
|---|---|---|
| CERT-In (Indian Computer Emergency Response Team) | MeitY | National agency for incident response since 2004; statutory under Section 70B; issues advisories; runs the Cyber Swachhta Kendra (botnet cleaning and malware analysis centre, 2017) |
| NCIIPC (National Critical Information Infrastructure Protection Centre) | NTRO | Protects CII; notified in 2014 under Section 70A |
| I4C (Indian Cyber Crime Coordination Centre) | MHA | Coordinates action against cybercrime; runs the National Cyber Crime Reporting Portal (cybercrime.gov.in) and the financial-fraud helpline 1930; inaugurated in January 2020 |
| National Cyber Security Coordinator | National Security Council Secretariat | Coordinates cyber security across ministries and agencies |
| Defence Cyber Agency | Ministry of Defence (Integrated Defence Staff) | Tri-service cyber operations |
National Cyber Security Policy, 2013 set the vision of a secure cyberspace, called for a 24x7 mechanism for CII protection, and aimed to create a workforce of 5 lakh cyber security professionals in five years.
Communication networks, media and social networking sites
The syllabus asks about the role of media and social networks — which cuts both ways.
| As a threat | As a tool for security |
|---|---|
| Misinformation and rumours triggering violence (for example, mob lynchings linked to rumours on messaging apps in 2018) | Real-time public warnings and official fact-checks |
| Online radicalisation and recruitment; propaganda by terror groups | Open-source intelligence; tracking of extremist networks |
| Deepfakes and coordinated influence operations | Community policing and citizen reporting (helplines, portals) |
| Encrypted coordination of crimes | Disaster alerts and crisis communication |
| Live coverage that may reveal security operations (as during 26/11) | Building public resilience and trust |
Constitutional balance
- Shreya Singhal v. Union of India (March 2015): Section 66A struck down as vague and overbroad under Article 19(1)(a), not saved by Article 19(2); Section 69A blocking upheld because it has safeguards; Section 79 read down — intermediaries must act on a court order or government notification.
- Anuradha Bhasin v. Union of India (January 2020): freedom of speech and trade through the internet is protected under Articles 19(1)(a) and 19(1)(g); suspension of internet services cannot be indefinite and orders must be published and reviewed, meeting the test of proportionality.
- K.S. Puttaswamy v. Union of India (2017): privacy is a fundamental right — the basis for the DPDP Act.
- Tehseen Poonawalla v. Union of India (2018): guidelines against mob lynching, including action against spreading irresponsible messages on social media.
Global regimes
- Budapest Convention on Cybercrime (2001), of the Council of Europe — the first international treaty on cybercrime. India is not a party; the reasons usually cited are that India had no role in drafting it and has concerns over its cross-border data-access provisions.
- India took part in the United Nations negotiations that produced the UN Convention against Cybercrime, adopted by the General Assembly in December 2024.
Memory Anchors
IT Act key sections — “66F Fights terror, 69A Axes content, 70A Armours CII, 70B Battles incidents.”
Who sits where — “Mei-CERT, NT-NCIIPC, Home-I4C”: CERT-In under MeitY; NCIIPC under NTRO; I4C under the Home Ministry.
The CIA triad: Confidentiality · Integrity · Availability.
For Prelims
- Section 66A of the IT Act was struck down in Shreya Singhal (2015); Section 69A (blocking) was upheld.
- Section 66F defines cyber terrorism; punishment may extend to life imprisonment.
- NCIIPC functions under the NTRO; CERT-In under MeitY; I4C under the MHA.
- CERT-In’s 2022 directions require reporting of specified incidents within 6 hours.
- India is not a party to the Budapest Convention (2001).
- The National Cyber Security Policy is of 2013.
For Mains
- Dimensions:
- Security: State-backed APTs, attacks on CII, cyber warfare as part of hybrid war.
- Economic: digital payments and fraud, ransomware costs, supply-chain risk from imported hardware and software.
- Legal: an IT Act drafted in 2000 for e-commerce; overlapping rules; need for a dedicated cyber security law.
- Institutional: many agencies, coordination gaps, shortage of skilled personnel, State police capacity for cybercrime.
- Rights: privacy (Puttaswamy), free speech (Shreya Singhal), proportionality of shutdowns (Anuradha Bhasin).
- International: attribution problems, absence of agreed norms, India’s position on Budapest.
- Keywords: critical information infrastructure, attack surface, zero-trust architecture, cyber hygiene, security by design, supply-chain security, attribution, cyber deterrence.
- Value-addition: CERT-In 2022 directions; NCIIPC under Section 70A; I4C and helpline 1930; Shreya Singhal (2015); Anuradha Bhasin (2020); DPDP Act (2023).
Common Traps
In the News
- November 2022 — ransomware attack on AIIMS, New Delhi.
- August 2023 — the Digital Personal Data Protection Act, 2023 enacted.
- December 2024 — the UN General Assembly adopted the UN Convention against Cybercrime → see current affairs.
Practice
Prelims
In Shreya Singhal v. Union of India (2015), the Supreme Court, with respect to the Information Technology Act, 2000, held that:
Solution
The Court struck down Section 66A as vague and overbroad, violating Article 19(1)(a) and not saved by Article 19(2). It upheld Section 69A (blocking) because it has safeguards, and read down Section 79 so that intermediaries need to act only on a court order or government notification.
Answer: D
Consider the following statements:
- The National Critical Information Infrastructure Protection Centre functions under the National Technical Research Organisation.
- CERT-In is the national agency for incident response under Section 70B of the Information Technology Act, 2000.
- The Indian Cyber Crime Coordination Centre functions under the Ministry of Electronics and Information Technology.
Which of the statements given above is/are correct?
Solution
Statements 1 and 2 are correct. Statement 3 is wrong — I4C functions under the Ministry of Home Affairs, since cybercrime is a policing matter. CERT-In is the agency under MeitY.
Answer: B
A cyber attack that encrypts an organisation’s data and demands payment to restore access is known as:
Solution
That is ransomware (for example, WannaCry in 2017). Phishing tricks a user into revealing information; a DDoS attack floods servers to make a service unavailable; a zero-day exploit uses an unpatched, previously unknown vulnerability — it may deliver ransomware but is not itself the extortion.
Answer: A
Mains
Critical information infrastructure has become a new frontier of national security. Evaluate the adequacy of India’s legal and institutional framework to protect it.
Solution
Introduction: Critical information infrastructure (CII) — power, banking, telecom, transport, health and government networks — is defined in Section 70 of the IT Act. Incidents such as the AIIMS ransomware attack (2022) show how a single breach can stop essential services.
Body:
- Framework: IT Act 2000 (Sections 66F, 70, 70A, 70B); NCIIPC under NTRO; CERT-In under MeitY with sectoral CERTs; National Cyber Security Coordinator in the NSCS; Defence Cyber Agency; National Cyber Security Policy 2013; CERT-In’s 2022 six-hour reporting rule; DPDP Act 2023.
- Strengths: clear nodal agencies; mandatory incident reporting; botnet cleaning (Cyber Swachhta Kendra); growing citizen-facing cybercrime system (I4C, 1930).
- Gaps: the IT Act is an e-commerce law adapted for security; the 2013 policy has not been replaced by an updated strategy; multiple agencies with overlapping roles; shortage of skilled personnel; dependence on imported hardware and software (supply-chain risk); uneven cyber hygiene in public bodies; India outside the Budapest Convention, complicating cross-border evidence.
- Way forward: a dedicated cyber security law and updated national strategy; security audits and “security by design” for CII; indigenous trusted supply chains; skilling; public–private information sharing; active role in UN norm-making.
Conclusion: India has built the institutions; the task now is to give them a modern legal basis, people and coordination worthy of a digital-first economy.
Quick Revision
| Point | One-liner |
|---|---|
| IT Act | 2000; amended 2008 for cyber security |
| 66A | Struck down — Shreya Singhal, 2015 |
| 66F | Cyber terrorism — up to life imprisonment |
| 69A | Blocking — upheld |
| 70A / 70B | NCIIPC (NTRO) / CERT-In (MeitY) |
| I4C | MHA; cybercrime.gov.in; helpline 1930 |
| Policy | National Cyber Security Policy, 2013 |
| CERT-In 2022 | 6-hour reporting; 180-day logs |
| DPDP Act | 2023; Data Protection Board of India |
| Budapest Convention | 2001; India not a party |
Key Takeaways
- Cyber security protects confidentiality, integrity and availability — and critical infrastructure is the highest-stakes target.
- The IT Act (Sections 66F, 69A, 70A, 70B) plus CERT-In, NCIIPC and I4C form India’s core framework; know which body sits where.
- Social media is both a threat vector and a security tool; courts insist that regulation stays proportionate.
Related Topics
- Cyber Security — quick revision
- Cyber Security — practice questions
- IT, Computers and Emerging Technologies
- Fundamental Rights
- Security Forces and Agencies