Cyber security: CERT-In, critical infrastructure and the IT Act

Cyber threats range from phishing and ransomware against individuals and hospitals to attacks on power grids, banks, railways and government networks. An attack on a power grid or a payment system is not only a crime; it can disrupt daily life for millions and, if timed with a physical crisis, compound it. Attribution is hard: an attacker may route traffic through several countries, use stolen credentials, or hide behind a criminal group, so certainty about who attacked is often lower than in a physical incident.

India's legal framework centres on the Information Technology Act, 2000, which provides for offences such as unauthorised access and data theft, and for the Indian Computer Emergency Response Team, CERT-In, established in 2004 as the national agency for incident response. CERT-In issues advisories, coordinates responses to incidents and, since 2022 directions, requires certain entities to report specified cyber incidents within six hours. The National Critical Information Infrastructure Protection Centre, set up under the IT Act, protects critical sectors such as power, banking, telecom and transport.

Policy has moved towards a national cyber security architecture, but India has not enacted a single comprehensive cyber security law; instead, CERT-In directions, sector regulators, the Digital Personal Data Protection Act, 2023, for personal data, and criminal law under the Bharatiya Nyaya Sanhita operate together. The National Cyber Security Policy dates to 2013 and has been widely described as outdated, with a successor strategy long discussed. Coordination gaps between Centre, states, regulators and private operators — who run much of the critical infrastructure — remain a central weakness.

For citizens, the most common cyber harm is not a state-sponsored attack but fraud: fake calls, phishing links and investment scams, often routed through mule accounts. Reporting, quick freezing of accounts and public awareness are therefore as important as high-end defence. A cyber policy that protects grids but not pensioners from fraud protects the state more than its people.