UPSC Mains 2013 GS Paper 3 Q23: model answer
Cyber warfare is considered by some defense analysts to be a larger threat than even Al Qaeda or terrorism. What do you understand by Cyber warfare? Outline the cyber threats which India is vulnerable to and bring out the state of the country's preparedness to deal with the same.
What the question wants
Explain cyber warfare, list the cyber threats India faces and assess how prepared India is.
How to structure it
Define, threats, preparedness.
- Cyber warfare vs terrorism comparison
- India's vulnerabilities
- Preparedness
- Gaps
How to think it through
Cyber warfare: state-backed attacks to disrupt/destroy critical systems: Estonia 2007, Stuxnet 2010, Ukraine grid 2015. Why bigger than al-Qaeda: low cost, deniable, scale, no borders. India threats: power grid, banking, nuclear (Kudankulam 2019 malware), defence, espionage, ransomware AIIMS 2022, telecom, elections, data theft. Preparedness: IT Act 2000/2008, NCSP 2013, CERT-In, NCIIPC 2014, Defence Cyber Agency 2019, I4C 2020, NCSC under NSCS, CERT-In 6-hour reporting 2022. Gaps: no NCSS final, skills shortage, imported hardware, coordination.
Model answer
In 2010, a computer worm called Stuxnet quietly damaged centrifuges at Iran's Natanz nuclear plant. No bomb went off, but a key part of a nuclear programme was set back. That is why some analysts call cyber warfare a bigger danger than al-Qaeda: it is cheap, deniable and can hit a whole country at once.
What cyber warfare means
- Attacks by states or their proxies on another country's computer systems to spy, disrupt or destroy.
- Examples: Estonia (2007), Stuxnet (2010) and the Ukraine power grid (2015).
India's vulnerabilities
- Critical infrastructure: power grids, as the Mumbai outage (2020) showed.
- Banking and payments as digital transactions rise.
- Nuclear and space facilities; malware was found at Kudankulam in 2019.
- Defence and government networks targeted for espionage.
- Hospitals and data: the AIIMS ransomware attack (2022).
- Imported hardware and software with possible backdoors.
India's preparedness
- IT Act, 2000 (amended 2008) and the National Cyber Security Policy, 2013.
- CERT-In for incident response; NCIIPC to protect critical systems.
- The Defence Cyber Agency (2019) and the National Cyber Security Coordinator under the NSCS.
- I4C (2020) for cyber crime.
Gaps
- No final National Cyber Security Strategy yet; the draft is still pending.
- A shortage of skilled professionals.
- Weak security in states, small firms and local bodies.
India is a digital giant with a still-growing shield; the gap between the two is the real threat.
Draw: A shield diagram: critical sectors inside, attack arrows outside, with India's agencies as layers of the shield.
Keywords, cases and data to drop in
cyber warfare, Stuxnet 2010, Estonia 2007, Ukraine grid 2015, Mumbai outage 2020, Kudankulam 2019, AIIMS 2022, IT Act 2000/2008, NCSP 2013, CERT-In, NCIIPC, Defence Cyber Agency 2019, NCSC, I4C 2020, NCSS draft.
Where most answers lose marks
- Only defining cyber warfare and skipping India's preparedness, which the question asks you to assess.
Related Mains PYQs
- Explain how fake news and disinformation pose threat to Internal Security and Public Order in Indian context? In this regard, discuss salient… UPSC 2026 · GS-III
- Describe the context and salient features of the Digital Personal Data Protection Act, 2023. UPSC 2024 · GS-III
- Social media and encrypting messaging services pose a serious security challenge. What measures have been adopted at various levels to address the… UPSC 2024 · GS-III
- What are the different elements of cyber security? Keeping in view the challenges in cyber security, examine the extent to which India… UPSC 2022 · GS-III
Fresh examples from current affairs
Vehicle data sold for ₹5: Centre orders CERT-In audit of VAHAN, SARATHI and e-Challan portals
The Ministry of Road Transport and Highways has asked CERT-In, India’s cyber-security agency, for a forensic audit of its VAHAN, SARATHI, e-Challan and pollution-certificate portals. A security firm found that owners’ names, addresses and phone numbers were being sold through apps and a Telegram channel for as little as ₹5. On the same day, The Hindu reported a separate leak of film certification records. For you, this connects cyber security, the right to privacy and the Digital Personal Data Protection Act, 2023.
UPSC angle: Prelims: CERT-In, Section 70B IT Act, VAHAN/SARATHI, Puttaswamy, DPDP Act 2023, GDPR. · Mains GS-III: cyber security and data protection.
25 Oct 2026
eMudhra weak-key flaw: browsers block 8 certificates; what it means for India’s web trust
Google, Mozilla, Apple and Microsoft have blocked eight intermediate certificates of Bengaluru-based eMudhra, India’s largest certifying authority, after a researcher found their private keys were tiny numbers between 1 and 256 instead of proper 384-bit keys. eMudhra revoked them, CERT-In issued an advisory on 21 October 2026 and MeitY set up a special team. India’s regulated digital signatures and eSign are unaffected.
UPSC angle: Prelims: CCA, CERT-In, TLS, eSign. · Mains GS-III: cyber security, digital trust, data protection.
22 Oct 2026
Open-weight AI models: why Big Tech gives them away and what it means for India
In October 2026 alone, Reflection AI, Meta, NVIDIA and Mistral released or announced open-weight AI models. The Hindu explained on 20 October why firms spend heavily and then let anyone download the weights: to win developers, set standards and earn from cloud, chips and services. For India, open weights offer a base to build Indian-language AI, but they also bring safety risks.
UPSC angle: Prelims: weights, open-weight vs open-source, IndiaAI, AI4Bharat. · Mains GS-III: AI sovereignty, safety and regulation.
21 Oct 2026
Supreme Court: children have a right to the internet, and platforms must block child abuse material
In a judgment of 15 October 2026, the Supreme Court said that the right to access and use the internet is a fundamental right of every person, children included, under Article 21 read with Article 19(1)(a). So the answer to online danger is not to lock children out but to go after the abusive content and the platforms that fail to remove it. The Court ordered a National Hash and URL List Database, two-hour reporting of unknown abuse material, and loss of revenue for platforms that profit from it through paywalls.
UPSC angle: Prelims: Arts. 21 and 19(1)(a); POCSO s.15; IT Act ss.67B and 79; CSEAM. · Mains GS-II: rights of children, regulation of platforms.
18 Oct 2026Learn the concept
Question text as printed in the official UPSC Civil Services (Main) question paper. The model answer is original Battle IAS work; use it to learn structure, not to memorise.
Want every PYQ in one place? See the Battle IAS PYQ Book.