Internal Security & Disaster Management
Cyber Security and Communication Networks
GS Paper III
Cyber Security — Quick Revision
One-page UPSC revision of cyber security: threat types, IT Act sections, CERT-In, NCIIPC, I4C, key judgments, data protection and social media in security.
SyllabusGS III · Challenges through communication networks, role of media and social networking sites, basics of cyber security
Cyber security on one page — sections, agencies and cases for Prelims, and a ready framework for Mains.
Threat Glossary
| Term | One-liner |
|---|---|
| Malware | Malicious software — virus, worm, trojan, spyware |
| Ransomware | Encrypts data, demands ransom (WannaCry, 2017; AIIMS Delhi, 2022) |
| Phishing | Deceptive messages to steal credentials |
| DDoS | Botnet floods a server to deny service |
| APT | Long-term stealthy intrusion, often State-backed |
| Zero-day | Exploit of an unknown, unpatched flaw |
| Botnet | Network of hijacked devices controlled remotely |
| Stuxnet | Worm discovered in 2010 that damaged Iranian centrifuges |
IT Act, 2000 — Sections to Know
| Section | Content |
|---|---|
| 43 | Civil liability for damage to computer systems |
| 66 | Computer-related offences |
| 66A | Struck down (Shreya Singhal, 2015) |
| 66F | Cyber terrorism (up to life imprisonment) |
| 69 | Interception, monitoring, decryption |
| 69A | Blocking of online content (upheld) |
| 70 | Protected systems (critical information infrastructure) |
| 70A | NCIIPC |
| 70B | CERT-In |
| 79 | Intermediary safe harbour |
Agencies
| Body | Under | Year | Role |
|---|---|---|---|
| CERT-In | MeitY | 2004 | Incident response, advisories |
| NCIIPC | NTRO | 2014 | Critical information infrastructure |
| Cyber Swachhta Kendra | CERT-In | 2017 | Botnet cleaning, malware analysis |
| I4C | MHA | 2020 | Cybercrime coordination; portal; helpline 1930 |
| National Cyber Security Coordinator | NSCS | — | National coordination |
| Defence Cyber Agency | MoD | — | Tri-service cyber operations |
High-yield facts
- CERT-In directions (April 2022): incident reporting within 6 hours; logs kept for 180 days.
- National Cyber Security Policy: 2013 — target of 5 lakh skilled professionals in five years.
- Budapest Convention (2001, Council of Europe): India not a party.
- DPDP Act, 2023 sets up the Data Protection Board of India.
- Telecommunications Act, 2023 replaced the Indian Telegraph Act, 1885.
Judgments
| Case | Year | Holding |
|---|---|---|
| Shreya Singhal v. Union of India | 2015 | 66A struck down; 69A upheld; 79 read down |
| K.S. Puttaswamy v. Union of India | 2017 | Privacy is a fundamental right |
| Tehseen Poonawalla v. Union of India | 2018 | Guidelines against mob lynching, including curbing inflammatory social media messages |
| Anuradha Bhasin v. Union of India | 2020 | Internet-based speech and trade protected; shutdowns must be proportionate, not indefinite, and published |
Social Media and Security — Mains Grid
| Threat | Response |
|---|---|
| Misinformation, rumours, deepfakes | Fact-checking, platform due diligence (IT Rules 2021), digital literacy |
| Radicalisation and recruitment | Monitoring under law, counter-narratives, de-radicalisation |
| Encrypted coordination | Lawful interception with oversight |
| Shutdown as a tool | Proportionality (Anuradha Bhasin), targeted rather than blanket action |
Traps
- 66A struck down; 69A upheld.
- NCIIPC → NTRO, CERT-In → MeitY, I4C → MHA.
- India is outside the Budapest Convention.
Related Topics
- Cyber Security: Threats, Laws and Institutions
- Cyber Security — practice questions
- IT, Computers and Emerging Technologies
- Security Forces and Agencies
Advertisement