Cyber Security

Data Privacy in the Digital Republic: India’s Governance Challenge

Context: International Data Privacy Day (28 January) commemorates the 2006 signing of Convention 108, the world’s first binding international treaty on data protection. The 2026 theme—“Take Control of Your Data”—underscores individual agency and informed consent in an increasingly data-driven economy.

What is Data Privacy?

Data privacy refers to an individual’s right to control how personal information is collected, processed, stored, and shared. In the digital age, it is a cornerstone of democratic governance, market trust, and national security.

In K.S. Puttaswamy v. Union of India (2017), the Supreme Court recognised the Right to Privacy as a fundamental right under Article 21, placing constitutional limits on state and private data use.

India’s Digital Scale and the Privacy Imperative

India is the third-largest digital economy, with nearly one billion internet users and about 70% penetration. Population-scale Digital Public Infrastructure (DPI)—Aadhaar, UPI, DigiLocker—has transformed service delivery but also amplified privacy risks. Ultra-low data costs (≈ $0.10/GB) have accelerated adoption, generating vast datasets that can be misused for profiling, AI-driven manipulation, and deepfakes.

State digitisation further heightens exposure. Platforms such as eSanjeevani (over 44 crore telemedicine consultations) and MyGov (over 6 crore users) handle sensitive personal data, making robust safeguards indispensable.

Recognising these risks, the Union Budget 2025–26 earmarked ₹782 crore for cybersecurity, signalling the growing salience of data protection in public policy.

Beyond citizen trust, privacy has economic value. Strong data governance improves investment confidence, enables cross-border digital trade, and positions Indian firms as credible global partners.

India’s Data Protection Architecture

India’s framework has evolved from sectoral rules to a comprehensive statute:

  • Information Technology Act, 2000: The parent law for cyber offences and electronic governance; Section 69A empowers content blocking for national security.
  • CERT-In: National nodal agency for cyber incident response and breach advisories.
  • IT Rules, 2021: Due diligence and grievance redressal obligations for intermediaries to ensure platform accountability.
  • Digital Personal Data Protection (DPDP) Act, 2023: India’s first comprehensive personal data law, built on the SARAL principle—Simple, Accessible, Rational, Actionable. It emphasises lawful purpose, consent, data minimisation, and accountability.
  • DPDP Rules, 2025: Operationalise enforcement, timelines, and compliance processes.
  • Data Protection Board of India (DPBI): A digital-first regulator for complaint filing and adjudication; appeals lie with TDSAT.

The Road Ahead

As India’s digital footprint expands, data protection must move from compliance to culture. Empowering users with meaningful consent, strengthening institutional capacity, and aligning innovation with privacy-by-design will be critical.

International Data Privacy Day is a reminder that safeguarding personal data is not merely a legal obligation—it is central to sustaining India’s digital transformation with trust and constitutional fidelity.

What is spyware Graphite?

Context: The US Immigration and Customs Enforcement (ICE) agency has signed a contract with an Israeli spyware company to access a powerful hacking software known as Graphite. 

Relevance of the Topic: Prelims: Key facts about Spyware Graphite. 

Spyware Graphite

Graphite is a powerful hacking software which can hack mobile phones and encrypted messaging applications.

  • The spyware is designed to gain remote access to a mobile phone and essentially take control of it. 
  • The user of the spyware can not only access the mobile user’s photos, read their messages, and track their whereabouts, but also monitor encrypted messages sent on platforms such as WhatsApp and Signal.
  • The spyware also enables the phone to be used as a listening device by manipulating its recorder.

Utility:

  • Can be used to crackdown on undocumented immigrants. 

Concerns:

  • Can be used to facilitate the surveillance of activists and journalists. Can pose a profound threat to free speech and privacy.
  • Can be used to violate people’s due process rights.

However, the firm claims that it sells its products to only governments and law enforcement agencies for the purposes of fighting serious crime. It has a zero-tolerance policy for governments that use the technology to target members of civil society.

APK Scam: How Fake Apps are used for Financial Fraud

Context: APK scam is one of the fastest-growing cybercrime threats in India. The sophisticated social engineering scam is driven by malicious Android Package Kit (APK) files that stay undetected and exploit public trust in digital systems. 

Relevance of the Topic:Prelims: Key facts about Android Package Kit (APK) Scam. Mains: Cybercrimes: Types, Challenges and Regulations. 

What is Android Package Kit (APK) Scam?

  • APK scams involve malicious files which are used to install apps on Android devices outside of the official App store. The App often has hidden malware that can steal personal data, passwords, banking information, or install spyware.
  • Rising cases: There has been a 900% jump in cyber crimes between 2021 and 2025. The National Cyber Crime Reporting Portal has logged over 12 lakh different types of APK Scams in India since the beginning of 2025 (till date). 

How does the APK Scam work?

  • APK files on Android devices are much like .exe files on Windows computers; both are used to install Apps. These files can be exploited by fraudsters to spread malware.
  • Fraudsters build or source these Apps to mimic the appearance and language of official portals (E.g., government subsidy schemes like PM-Kisan, tax refund platforms, electricity boards, or banks asking for KYC updates). 
  • These fake Apps are often circulated through social media platforms and accompany convincing messages that urge users to act immediately. Once downloaded, the App seeks multiple permissions including access to contacts, messages, call logs, location, microphone, and notifications.
  • The App harvests data in real-time, and transmits it in encrypted bits to external servers operated by fraudsters. These bits are decoded to extract valuable information, including banking credentials, OTPs, contacts, and location coordinates etc. 
image 14

Challenges: 

  • Google or any other intermediary does not scrutinise every application that is being hosted on their server. Fraudsters use mule accounts and shell identities to pay for hosting and publishing on search engines. 
  • Strong encryption techniques hide malicious code from detection tools. By remaining dormant during installation certain APKs can bypass antivirus softwares. 
  • Even after earlier versions are blacklisted, the same APK file is reused with minor modifications in the interface (name, logo and URL or web address of the file) thus, allowing it to bypass detection. 

Also Read: How is Cyberbullying tackled under the Law in India? 

How is Cyberbullying tackled under the Law in India?

Context: India does not have a dedicated law to tackle cyber crimes at present. Instead, the provisions under the Bharatiya Nyaya Sanhita 2023, and the Information Technology Act 2000 are used to deal with such cases. 

What are Cybercrimes?

  • Cybercrimes referto a range of criminal activities carried out using computers and the internet. Common cybercrimes include-
    • Hacking
    • data theft and financial fraud
    • phishing and impersonation
    • malware attacks and ransomware
    • cyberbullying and digital arrest 
    • stalking and doxxing (unauthorised release of private information). 
  • Cybercrimes in India have increased 60.9% from 2022 to 2023, resulting in the loss of over Rs. 10,000 crores over the past three years. Cybercrimes disproportionately affect women and minorities. 

What is Cyberbullying?

  • Cyberbullying is the use of technology to intentionally and repeatedly harass, threaten, embarrass, or target another person viz. offensive messages, hate speech, derogatory content, doctored images, doxxing and threats of physical or sexual violence. 

Existing laws to tackle Cyberbullying in India:

India lacks a dedicated law to address online hate speech and trolling. 

  • Provisions under the Bharatiya Nyaya Sanhita (BNS) 2023, and the Information Technology (IT) Act 2000 cover certain aspects of cyberbullying. 
  • BNS includes provisions such as Section 74 (assault or criminal force against a woman with intent to outrage her modesty), Section 75 (sexual harassment), Section 351 (criminal intimidation), Section 356 (defamation), and Section 196 (promoting enmity between groups). 
  • The IT Act includes provisions like Section 66C (identity theft), Section 66D (impersonation fraud), and Section 67 (publishing or transmitting obscene material electronically).

Limitations of Existing Frameworks

1. Absence of dedicated law on Cyberbullying: 

  • The existing regulatory framework is functional but incomplete. Sustained online abuse that does not qualify as obscene, threatening, or fraudulent often falls outside the purview of criminal law. 
  • Offences like criminal intimidation or defamation often require proof of threat or reputational harm, and are not-suited to counter the rapid, anonymous abuse unleashed by online mobs.

2. Legal ambiguity around Doxxing and Public data: 

  • The Delhi High Court in a case involving doxxing (2024) ruled that while doxxing raised privacy concerns, the concerned incident did not constitute doxxing as the information was already publicly available. 
  • The Digital Personal Data Protection Act, 2023, exempts from regulation personal data that is made publicly available, either by the individual concerned or by an entity under a legal obligation. However, it does not define what qualifies as publicly available data. 
  • This lack of clarity on what qualifies as public information may inadvertently enable cybercrimes such as doxxing, given the ease with which fragmented data from multiple platforms can be easily aggregated and used for harassment or intimidation.

3. Concerns over Censorship: 

  • Section 69A of the IT Act empowers the government to issue blocking orders on grounds aligned with constitutionally permissible speech restrictions, such as sovereignty, friendly relations with foreign States, and public order. 
  • Platforms failing to comply risk losing safe harbour protection under Section 79, which shields intermediaries from liability for user-generated content. 
  • However, these provisions are increasingly being used for censorship with content taken down without r notification, thus, violating the Supreme Court’s 2015 ruling in Shreya Singhal versus Union of India. E.g., After the Pahalgam attack, X disclosed that it had been directed to block 8,000 accounts in India.  

Government Initiatives to enhance Cybersecurity in India: 

  • IT Act 2000: Provides a legal framework for dealing with cyber crimes.  
  • CERT-In: Nodal agency to deal with cyber-security threats like hacking or phishing.
  • National Cyber-Security Policy 2013 to provide an overarching framework to deal with cybersecurity.
  • Indian Cyber Crime Coordination Centre (I4C): enhances the coordinated response of law enforcement agencies to cybercrimes.  
  • National Critical Information Infrastructure Protection Centre - nodal agency to protect India’s Critical Information Infrastructure.
  • National Cyber Crime Reporting Portal to report cyber crimes. 
  • Defence Cyber Agency  to protect military systems and conduct offensive cyber-operations.
  • Enactment of Digital Personal Data Protection Act 2023 for regulation and protection of personal data.

Also Read: National Cyber Security Strategy 

What is Digital Arrest?

Context: The Central Bureau of Investigation (CBI) has launched Operation Chakra-V against Transnational Organised Cybercrime and Digital Arrests. Digital arrest is one of the many large-scale organised cybercrimes in India.

Relevance of The Topic: Prelims- Key facts about Digital Arrest. 

Digital Arrest

  • A digital arrest is a type of cyber fraud in which scammers pose as law enforcement or government officials and use intimidation tactics to manipulate victims.
    • They claim that the victim is under investigation for crimes such as money laundering or other legal issues.
    • To make their threats more convincing, scammers may use fake video or phone calls, falsely stating the victim is "digitally arrested" or at risk of severe consequences unless they comply.
  • According to Indian Cyber Crime Coordination Centre (I4C), Indians are likely to lose over ₹1.2 lakh crore, roughly 0.7% of the GDP, over the next year due to cyber frauds.
Digital Arrest 1
Digital Arrest 2

What is GPS Spoofing? 

Context: Indian Air Force’s transport aircraft carrying relief materials to earthquake-hit Myanmar faced “GPS spoofing”. India sent relief materials to Myanmar in a C-130J aircraft and its pilots reported that the plane's GPS signal was tampered with, when it was in Myanmar’s airspace.

Relevance of the Topic:  Prelims: Key facts related to GPS Spoofing.

GPS Spoofing

  • GPS (global positioning system) spoofing is a form of cyberattack that includes generating false GPS signals to mislead an aircraft, ships and vehicles. The false signals result in misleading the navigation equipment, posing a significant risk to the aircraft, ships etc. 
image 15

How does GPS Spoofing work?

  • GPS spoofing exploits the inherent vulnerabilities in the GPS infrastructure – the weak signal strength of GPS satellites. GPS systems function by sending signals from satellites to GPS receivers on Earth. These receivers then calculate their position based on the time it takes for these signals to arrive.
  • However, due to the weak signal strength of the GPS satellites, these signals can be easily overwhelmed by fake signals, resulting in inaccurate location data on the receiving device.
  • The act of GPS spoofing typically involves using a signal generator or other sophisticated equipment to transmit counterfeit GPS signals that are stronger than the genuine satellite signals. These false signals, when picked up by a GPS receiver, can cause it to calculate an incorrect position or time.

Some entities that may carry out GPS spoofing

  • Governments/military: defence, sensitive facility protection, tactical warfare, espionage etc.
  • Criminals/hackers: illegal activities, transportation or communication systems disruption, cargo theft, victim tracking, stalking.
  • Private organisations: location manipulation, competitive advantage, fraud etc.  

Measures to prevent GPS Spoofing: 

  • As a response to the increasing prevalence of GPS spoofing, various countermeasures are being developed to secure GPS-based systems, including signal strength monitoring, time-of-arrival analysis, and cryptographic authentication.
  • Furthermore, experts suggest the use of multiple satellite navigation systems to cross-verify and validate positioning data, thus minimising the risk of spoofing attacks.

Also Read: How Global Positioning System (GPS) work?

Cyber Volunteer Framework under I4C

Context: According to the annual report of the Ministry of Home Affairs, the Ministry and various State governments have roped in around 54,800 persons as Cyber Crime Volunteers to flag unlawful content on the Internet, for the year 2023-24.

Relevance of the Topic: Prelims: Cyber Volunteer Framework; Indian Cyber Crime Coordination Centre. 

Cyber Volunteer Framework

  • Launched by: The Indian Cyber Crime Coordination Centre (I4C), under the Ministry of Home Affairs in 2020.
  • Aim: To bring together citizens with passion to serve the nation on a single platform and contribute in the fight against cybercrime in the country.
  • Significance: The Framework enables citizens to enrol as cyber volunteers for reporting unlawful content, dissemination of cyber hygiene, and as cyber experts to aid law enforcement.
  • Criticism: The Internet Freedom Foundation (IFF), a digital liberties organisation, had criticised the scheme stating that it will lead to a culture of surveillance and constant suspicion in society creating potential social distrust.

How to be a Cyber Volunteer?

  • The volunteers can register through the portal http://www.cybercrime.gov.in and flag unlawful content. 
  • The unlawful content has been categorised as any material:
    • against sovereignty and integrity of India
    • against defence of India
    • against security of the State
    • against friendly relations with foreign States. 
    • content aimed at disturbing public order, disturbing communal harmony
    • material related to child sex abuse.
image 11

Indian Cyber Crime Coordination Centre (I4C)

  • Initiative of: Ministry of Home Affairs. 
  • Aim: To deal with cyber crime in the country in a coordinated and comprehensive manner.
  • I4C works towards improving coordination among the Law Enforcement Agencies and the stakeholders and enhancing the nation’s collective capability to tackle cybercrimes
  • I4C has partnered with Google and Facebook for sharing intelligence and signals for proactive identification and action on cyber criminals. 
    • Cyber fraudsters have been using digital platforms (like Google services platforms) for initiating organised investment crimes and the I4C has partnered with the Internet search giant to flag such content. 

Objectives of I4C

  • To act as a nodal point to curb Cybercrime in the country.
  • To strengthen the fight against Cybercrime committed against women and children.
  • Facilitate easy filing Cybercrime related complaints and identifying Cybercrime trends and patterns.
  • To act as an early warning system for Law Enforcement Agencies for proactive Cybercrime prevention and detection.
  • Awareness creation among the public about preventing Cybercrime.
  • Assist States/UTs in capacity building of Police Officers, Public Prosecutors and Judicial Officers in the area of cyber forensic, investigation, cyber hygiene, cyber-criminology, etc.

World Cybercrime Index (WCI)

Context: The first edition of World Cybercrime Index has been published by researchers from University of Oxford.

Overview of the World Cybercrime Index (WCI)

  • First-ever global ranking of countries by level of cybercrime threat published by researchers of University of Oxford and UNSW Canberra.
  • Based on research by an international team of experts
  • Ranks the most significant sources of cybercrime at the national level
  • Shows a small number of countries are key cybercrime hotspots
  • Covers five major categories of cybercrime:
    • Technical products/services (malware, botnets, hacking tools)
    • Attacks and extortion (denial-of-service, ransomware)
    • Data/identity theft (hacking, phishing, account compromises)
    • Scams (advance fee fraud, business email compromise)
    • Cashing out/money laundering (credit card fraud, money mules)

Top Cybercrime Hotspots

image 30

Specialization of Countries in Cybercrime

  • Russia and Ukraine: highly technical cybercrime hubs
  • Nigeria: less technical forms of cybercrime, such as scams
  • Romania and US: both high-tech and low-tech crimes
  • India: mid-tech crimes, specializing in scams, considered a "balanced hub"

Challenges in Cybercrime Tracking

  • Offenders mask physical locations behind fake profiles and technical protection.
  • Cybercriminals cannot be easily accessed or surveyed directly due to the illicit, anonymous nature of their activities
  • Technical data is insufficient to map locations as attacks are routed globally

Significance of the WCI

Significance of the WCI

Cybercrime as a Global Issue & Socio-Economic Impact of Cybercrime

Cybercrime as a Global Issue & Socio-Economic Impact of Cybercrime

Relevance to India

  • Ranks 10th in the World Cybercrime Index: India's high ranking in the WCI highlights the significant level of cybercrime threat the country faces.
  • Cybercrime complaints soared by 200% in 2023, with financial losses reaching ₹168.5 crores.
  • Mumbai, Delhi, and Bangalore are among the world's top cities for ransomware detections.
  • The Indian cybersecurity market size is projected to exhibit a growth rate (CAGR) of 16.5% during 2024-2032. It is estimated at USD 4.70 billion in 2024, and is expected to reach USD 10.90 billion by 2029, growing at a CAGR of 18.33% during the forecast period (2024-2029).
  • The Indian government's launch of the National Cyber Security Policy and the establishment of the Indian Cyber Crime Coordination Centre (I4C) demonstrate its recognition of the cybercrime threat and its commitment to strengthening the country's cybersecurity posture. 
  • The Bureau of Police Research & Development (BPR&D) has developed a Training of Trainers module and several training programmes for various levels of police personnel on the new criminal laws.

What are Dark Patterns?

Context: The Consumer Affairs Secretary has said that the dark patterns practices carried out by airlines and travel portals can be deemed cyber-crimes.

Dark Patterns

  • Dark patterns are found in various digital interfaces including websites, mobile apps, and online services.
  • These are deceptive design techniques or user interface elements intentionally crafted to trick or manipulate users into making choices that are detrimental to their interests. E.g., Buying a more expensive product, paying more than what was initially disclosed, sharing data, making choices based on false or paid-for reviews, subscription services or recurring payments without their explicit consent.
  • Engaging in manipulative conduct using dark patterns in online platforms constitutes unfair trade practice under the Consumer Protection Act 2019.

Types of Dark Patterns

image 91

Bharat NCX 2023

Context: National Security Council Secretariat is going to organise the 2nd edition of National Cyber Security Exercise ‘Bharat NCX’ for Government organisations, Public and Private sector to strengthen India’s cyber posture.

About Bharat NCX 2023

  • Bharat NCX is India’s National Cyber Security Exercise to be conducted over a period of 12 days in October 2023.
  • It aims to train senior management and technical personnel of Government/Critical Sector organisations, Public and Private agencies on contemporary cyber threats and handling cyber incidents and response.
  • Conducted by National Security Council Secretariat (NSCS) in partnership with Rastriya Raksha University (RRU).
  • Participants will be trained in cyber-security areas like Intrusion Detection Techniques, Malware Information Sharing Platform (MISP), Vulnerability Handling & Penetration Testing, Network Protocols & Data Flows, Digital Forensics etc.

Critical cyber security concerns

  • Protection of digital public infrastructure
  • Security of hardware involved in cyber infrastructure
  • Post quantum cryptography and need to become quantum safe
  • Evolving a collective vigilance to protect digital assets
  • Development of workforce adept in cyber-security

Army to raise Command Cyber Operations and Support Wings

Context: The Army Commanders Conference (ACC) that was held. The ACC had decided to operationalise Command Cyber Operations and Support Wings (CCOSWs) in the immediate future with current focus on net-centric operations.

  • These organisations will assist the formations to undertake the mandated cyber security functions to strengthen the cyber security posture of the Army. As Cyberspace has emerged as an important component of military domain both in grey-zone warfare as well as conventional operations and Indian Army too is rapidly migrating towards net-centricity, which entails increased reliance on modern communication systems at all levels.

About Grey zone Warfare

Grey zone warfare refers to employing aggression and other actions to achieve national objectives below the threshold of armed conflict and the ambiguity it creates. 

The characteristics of the Grey zone  warfare can be identified by 

  • Grey zone elements remain below the threshold that would justify a military response, often through the use of non-military tools. 
  • The second common characteristic of grey zone activities is that they unfold gradually over time rather than involving bold, all-encompassing actions to achieve objectives in one step. The progressive unfolding of aggressive moves over the years, or even decades, reduces opportunities for decisive responses as a counter. 
  • The third characteristic, which applies to some but not all the activities in this sphere, is a lack of attributability. Most grey zone campaigns involve actions, whereby the aggressor aims for plausible deniability of its action. Whether it is cyberattacks or disinformation campaigns or the use of proxy forces, these actions allow a grey zone aggressor to deflect responses—and obstruct the potential for successful deterrence—by simply denying that it is responsible.

For example  in cases where grey zone actions are open and attributable, such as China’s approach in the South China Sea, they are justified using extensive legal and political argument. Fourthly, grey zone campaigns target specific vulnerabilities in the targeted countries. Grey zone aggressors also typically aim to put the defenders in situations where strong responses appear ruled out or counterproductive for strategic and domestic political reasons. In other words, grey zone warfare takes advantage of strategic ambiguity to achieve gradual gains.

Telecom authorities have blocked as many as 120 headers operated by a group linked to a Chinese entity

Context: Telecom authorities have blocked as many as 120 headers operated by a group linked to a Chinese entity in the past two months based on information provided by the Union Home Ministry.

What is a header?

  • A header, also known as sender ID, is a unique combination of characters or numbers representing the brand or company name of the message sender. 
  • Headers are used by banks, marketing companies, utility providers and even government offices to send bulk messages (SMS) to consumers and customers.

Current Issue?

An investigation by the Indian Cyber Crime Coordination Centre (I4C) found that the headers were hosted from China.

  • The particular example in this case was the header of West Bengal State Electricity Distribution Company Ltd.  WBSEDC was compromised and taken over by a Chinese host. 
  • The header was misused to dupe consumers who received messages pertaining to outstanding electricity bills. These SMS contained malicious links, which when clicked would lead to financial loss for the consumer as the hacker would get access to the person’s phone.
  •  Consumers would fall for it as the header genuinely belongs to the electricity distribution company.
  • Further it is for the Threat Analytical Unit (TAU) of the I4C, that analyses the pattern of financial crimes and frauds and sends reports to central agencies such as the National Investigation Agency (NIA), Enforcement Directorate or State police forces.

About Indian Cybercrime Coordination Centre (I4C) 

Indian Cybercrime Coordination Centre (I4C)  is an initiative of the Ministry of Home Affairs, Government of India to deal with cybercrime in the country in a coordinated and comprehensive manner.

I4C focuses on tackling all the issues related to Cybercrime for the citizens, which includes improving coordination between various Law Enforcement Agencies and the stakeholders, driving change in India's overall capability to tackle Cybercrime and to improve citizen satisfaction levels.

Objectives of I4C

  • To act as a nodal point to curb Cybercrime in the country.
  • To strengthen the fight against Cybercrime committed against women and children.
  • Facilitate easy filing Cybercrime related complaints and identifying Cybercrime trends and patterns.
  • To act as an early warning system for Law Enforcement Agencies for proactive Cybercrime prevention and detection.
  • Awareness creation among public about preventing Cybercrime.
  • Assist States/UTs in capacity building of Police Officers, Public Prosecutors and Judicial Officers in the area of cyber forensic, investigation, cyber hygiene, cyber-criminology, etc.

The Components of the I4C Scheme

  • National Cybercrime Threat Analytics Unit (TAU)
  • National Cybercrime Reporting
  • Platform for Joint Cybercrime Investigation Team
  • National Cybercrime Forensic Laboratory (NCFL) Ecosystem
  • National Cybercrime Training Centre (NCTC)
  • Cybercrime Ecosystem Management Unit
  • National Cyber Crime Research and Innovation Centre

About National Cybercrime Threat Analytics Unit (NCTAU)

  • It is a platform for Law Enforcement Agencies (LEAs), persons from private sector, academia and research Organisations to work collaboratively in order to analyse all pieces of information relating to Cybercrime. 
  • This unit collects Cybercrime feeds from open sources, National Cybercrime Reporting Portal, CERT-In, and other agencies working in this field, analyse it and further disseminates it to the concerned agencies for taking further appropriate action.