UPSC Mains 2021 GS Paper 3 Q10: model answer
Keeping in view India’s internal security, analyze the impact of cross-border cyber-attacks. Also, discuss defensive measures against these sophisticated attacks.
What the question wants
Analyse how cross-border cyber attacks affect India's internal security and discuss defences against sophisticated attacks.
How to structure it
Impact with examples, then defences.
- Examples
- Impacts
- Defences
How to think it through
Examples: Mumbai grid Oct 2020 (RedEcho), Kudankulam 2019 (Lazarus-linked DTrack), AIIMS Nov 2022, Cosmos Bank Aug 2018 ₹94 crore, ICMR data leak 2023, Operation Sindoor-time DDoS on government sites 2025. Impacts: critical infra, economy, data, espionage, trust, defence. Defences: CERT-In directions April 2022 (6-hour reporting, logs 180 days), NCIIPC, trusted telecom sources (2021), app bans under 69A (June 2020, 59 Chinese apps), zero trust, air-gapping, threat intelligence sharing, international cooperation, skilled workforce.
Model answer
In August 2018, hackers using malware on Cosmos Bank's ATM switch withdrew about ₹94 crore in two days through ATMs in 28 countries. Attacks like this, and the probing of Mumbai's grid in 2020, show that cross- border cyber attacks strike India from far away.
Impact on internal security
- Critical infrastructure: power grids, ports and nuclear plants, like the malware at Kudankulam (2019).
- Health and data: the AIIMS ransomware attack (2022).
- Financial losses and trust in digital payments.
- Espionage on defence and government networks.
- Disinformation campaigns during crises.
- Public panic when hospitals, trains or banks stop working.
Defensive measures
- CERT-In's 2022 directions: report incidents within 6 hours and keep logs.
- NCIIPC protection of critical sectors.
- Trusted telecom sources (2021) to keep risky equipment out.
- App bans under Section 69A, as in June 2020.
- Zero-trust networks, air-gapped systems and regular audits.
- Threat intelligence sharing with friendly countries.
- Skilled cyber workforce in government, and drills with private operators of critical systems.
A border in cyberspace is drawn by firewalls and good habits, not by fences.
Draw: A layered defence diagram: perimeter, network, system, data, people.
Keywords, cases and data to drop in
Cosmos Bank 2018 (₹94 crore), Mumbai grid 2020, RedEcho, Kudankulam 2019, AIIMS 2022, CERT-In 2022 directions (6 hours), NCIIPC, trusted telecom sources 2021, Section 69A app bans June 2020, zero trust, air-gapping.
Where most answers lose marks
- Not linking cyber attacks to 'internal security' as the question frames it.
Related Mains PYQs
- Explain how fake news and disinformation pose threat to Internal Security and Public Order in Indian context? In this regard, discuss salient… UPSC 2026 · GS-III
- Describe the context and salient features of the Digital Personal Data Protection Act, 2023. UPSC 2024 · GS-III
- Social media and encrypting messaging services pose a serious security challenge. What measures have been adopted at various levels to address the… UPSC 2024 · GS-III
- What are the different elements of cyber security? Keeping in view the challenges in cyber security, examine the extent to which India… UPSC 2022 · GS-III
Fresh examples from current affairs
Vehicle data sold for ₹5: Centre orders CERT-In audit of VAHAN, SARATHI and e-Challan portals
The Ministry of Road Transport and Highways has asked CERT-In, India’s cyber-security agency, for a forensic audit of its VAHAN, SARATHI, e-Challan and pollution-certificate portals. A security firm found that owners’ names, addresses and phone numbers were being sold through apps and a Telegram channel for as little as ₹5. On the same day, The Hindu reported a separate leak of film certification records. For you, this connects cyber security, the right to privacy and the Digital Personal Data Protection Act, 2023.
UPSC angle: Prelims: CERT-In, Section 70B IT Act, VAHAN/SARATHI, Puttaswamy, DPDP Act 2023, GDPR. · Mains GS-III: cyber security and data protection.
25 Oct 2026
eMudhra weak-key flaw: browsers block 8 certificates; what it means for India’s web trust
Google, Mozilla, Apple and Microsoft have blocked eight intermediate certificates of Bengaluru-based eMudhra, India’s largest certifying authority, after a researcher found their private keys were tiny numbers between 1 and 256 instead of proper 384-bit keys. eMudhra revoked them, CERT-In issued an advisory on 21 October 2026 and MeitY set up a special team. India’s regulated digital signatures and eSign are unaffected.
UPSC angle: Prelims: CCA, CERT-In, TLS, eSign. · Mains GS-III: cyber security, digital trust, data protection.
22 Oct 2026
Open-weight AI models: why Big Tech gives them away and what it means for India
In October 2026 alone, Reflection AI, Meta, NVIDIA and Mistral released or announced open-weight AI models. The Hindu explained on 20 October why firms spend heavily and then let anyone download the weights: to win developers, set standards and earn from cloud, chips and services. For India, open weights offer a base to build Indian-language AI, but they also bring safety risks.
UPSC angle: Prelims: weights, open-weight vs open-source, IndiaAI, AI4Bharat. · Mains GS-III: AI sovereignty, safety and regulation.
21 Oct 2026
Supreme Court: children have a right to the internet, and platforms must block child abuse material
In a judgment of 15 October 2026, the Supreme Court said that the right to access and use the internet is a fundamental right of every person, children included, under Article 21 read with Article 19(1)(a). So the answer to online danger is not to lock children out but to go after the abusive content and the platforms that fail to remove it. The Court ordered a National Hash and URL List Database, two-hour reporting of unknown abuse material, and loss of revenue for platforms that profit from it through paywalls.
UPSC angle: Prelims: Arts. 21 and 19(1)(a); POCSO s.15; IT Act ss.67B and 79; CSEAM. · Mains GS-II: rights of children, regulation of platforms.
18 Oct 2026Learn the concept
Question text as printed in the official UPSC Civil Services (Main) question paper. The model answer is original Battle IAS work; use it to learn structure, not to memorise.
Want every PYQ in one place? See the Battle IAS PYQ Book.