Cyber Security in India: Types of Threats, Legal Framework, Institutions, Recent Attacks and the Way Forward (UPSC Notes + PYQs)
UPSC has already asked about this. Read the story with these questions in mind.
Types of threats
- Malware: viruses, worms, trojans; ransomware encrypts data for ransom (WannaCry 2017, a 2018 Prelims question).
- Phishing and social engineering; SIM swap fraud.
- DDoS attacks that flood servers.
- Advanced persistent threats by state-linked groups targeting power grids and ports.
- Cyber fraud: fake investment apps, loan apps, digital arrest calls.
Incidents that changed policy
The AIIMS Delhi ransomware attack (November 2022) took hospital systems offline for days. Reports in 2021 linked Chinese groups to Mumbai’s grid outage of October 2020. The Kudankulam plant’s administrative network was breached in 2019. Cybercrime complaints on the national portal crossed 22 lakh in 2024, with reported losses of over ₹22,000 crore.
Legal and policy framework
- IT Act, 2000 (amended 2008); Section 66A was struck down in Shreya Singhal (2015).
- CERT-In directions (2022): report incidents within 6 hours; keep logs for 180 days.
- National Cyber Security Policy, 2013; a new strategy has been drafted.
- Digital Personal Data Protection Act, 2023, with Rules notified in 2025.
- Telecommunications Act, 2023 and the Sanchar Saathi portal against SIM misuse.
- Bharatiya Nyaya Sanhita (2023) covers organised cybercrime.
Institutions
CERT-In (MeitY), NCIIPC under NTRO for critical sectors, the National Cyber Security Coordinator in the NSCS, I4C in the Home Ministry with the 1930 helpline and cybercrime.gov.in portal, the Defence Cyber Agency, and sectoral CSIRTs for power and finance.
Gaps and way forward
Shortage of skilled professionals, dependence on imported hardware, weak cyber hygiene in government offices, and low conviction rates. Steps: a standalone cyber security law, trusted-source rules for telecom equipment, cyber insurance (a 2020 Prelims topic), public awareness, and international cooperation; India has not joined the Budapest Convention but takes part in UN processes.
Cyber Security: UPSC angle
For UPSC CSE
Prelims: agencies, laws, terms (ransomware, phishing). Mains GS-III: cyber threats to critical infrastructure, institutional gaps, cybercrime.
Cyber Security UPSC PYQs (Prelims)
Questions UPSC has actually asked, from the official papers. Pick an option to check yourself.
In India, it is legally mandatory for which of the following to report on cyber security incidents ?
– 1. Service providers
– 2. Data centres
– 3. Body corporate
Select the correct answer using the code given below :
Under the IT Act (section 70B) and the CERT-In Rules, 2013, service providers, intermediaries, data centres and body corporates must report cyber incidents to CERT-In. The 2022 directions set a deadline of six hours. Answer as per the official UPSC key · Battle IAS PYQ bankAnswer (d) & why
There are 24 equally spaced points lying on the circumference of a circle. What is the maximum number of equilateral triangles that can be drawn by taking sets of three points as the vertices?
EternalBlue was an NSA-developed Windows exploit that leaked online. WannaCry (May 2017) and Petya/NotPetya (June 2017) were ransomware attacks that used it to spread worldwide. Hospitals, ports and companies were hit, including in India. Answer as per the official UPSC key · Battle IAS PYQ bankAnswer (c) & why
In India, under cyber insurance for individuals, which of the following benefits are generally covered, in addition to payment for the loss of funds and other benefits ?
– 1. Cost of restoration of the computer system in case of malware disrupting access to one's computer
– 2. Cost of a new computer if some miscreant wilfully damages it, if proved so
– 3. Cost of hiring a specialized consultant to minimize the loss in case of cyber extortion
– 4. Cost of defence in the Court of Law if any third party files a suit
Select the correct answer using the code given below :
Personal cyber insurance covers losses from online fraud and attacks: restoring data and systems after malware, consultants’ fees in cyber extortion, and legal defence costs if someone sues. It does not buy a new computer after physical damage; that is the job of ordinary property insurance. Answer as per the official UPSC key · Battle IAS PYQ bankAnswer (b) & why
Mains PYQs on this topic
Questions from the official UPSC Mains papers (2023-2026 in the Battle IAS Mains bank), newest first. Each links to a model answer.
- UPSC Mains 2024 · GS Paper III · Q20 · 15 marks
Social media and encrypting messaging services pose a serious security challenge. What measures have been adopted at various levels to address the security implications of social media? Also suggest any other remedies to address the problem.
Quick quiz
Under CERT-In directions (2022), cyber incidents must be reported within
Logs kept for 180 days.Answer (b)
NCIIPC protects
Under NTRO.Answer (b)
WannaCry, Petya and EternalBlue relate to
UPSC 2018.Answer (b)
FAQs
What is a “digital arrest” scam?
Fraudsters pose as police or officials on video calls, claim the victim is under investigation, and extort money; no such arrest exists in law.
What is the 1930 helpline?
The national cybercrime helpline run under I4C for reporting financial fraud quickly.
Is India a party to the Budapest Convention?
No.
Which section of the IT Act was struck down?
Section 66A, in Shreya Singhal v. Union of India (2015).
Spotted an error? Tell us. We correct within 48 hours.
Image: Abigor, Wikimedia Commons, CC BY-SA 3.0
How to use this in Mains
If asked: UPSC Mains 2024, GS-III: Social media and encrypting messaging services pose a serious security challenge. What measures have been adopted at various levels to address the security implications of social media? Also suggest any other remedies to address the problem.
Quote: “Shortage of skilled professionals, dependence on imported hardware, weak cyber hygiene in government offices, and low conviction rates.”
Use it: Use as the gap analysis in the body.
In the news
CCPA acts against online sale of explosives: 3,940 sellers delisted from seven platforms
The Central Consumer Protection Authority (CCPA) said on 19 October 2026 that 3,940 sellers of regulated explosives such as ammonium nitrate, picric acid and PETN have been delisted from seven online platforms after its action. It has fined Dial4Trade and ExportersIndia ₹10 lakh per order, and other cases are under hearing or investigation.
19 Oct 2026
Supreme Court: children have a right to the internet, and platforms must block child abuse material
In a judgment of 15 October 2026, the Supreme Court said that the right to access and use the internet is a fundamental right of every person, children included, under Article 21 read with Article 19(1)(a). So the answer to online danger is not to lock children out but to go after the abusive content and the platforms that fail to remove it. The Court ordered a National Hash and URL List Database, two-hour reporting of unknown abuse material, and loss of revenue for platforms that profit from it through paywalls.
18 Oct 2026
First BIMSTEC Home Ministers Meeting adopts Delhi Declaration on security
India hosted the first BIMSTEC Home Ministers Meeting in New Delhi on 13 October 2026. The seven member States adopted the Delhi Declaration, condemning terrorism including cross-border terrorism, and called for full use of the BIMSTEC anti-terror and mutual legal assistance conventions. A Disaster Management Centre is planned in Jamnagar, Gujarat.
13 Oct 2026
Navy launches Next Generation Offshore Patrol Vessel “Shreyas” at GRSE Kolkata
The Indian Navy launched Shreyas (Yard 3040), a Next Generation Offshore Patrol Vessel, at GRSE Kolkata on 10 October 2026. NGOPVs are being built at two shipyards, GSL Goa and GRSE Kolkata, for surveillance, search and rescue, offshore asset protection, disaster relief and anti-piracy. Shreyas means best or most excellent in Sanskrit.
10 Oct 2026