Cyber-security, the space economy & dual-use technology
Cyber-security architecture, the commercialised space economy and dual-use technology controls for UPSC GS-3, with named statutes, agencies and dated instances.
The threat landscape and India's institutional response
Cyber-security is a GS-3 staple because it sits at the intersection of internal security, economy and technology. India is among the most-targeted nations globally; CERT-In (the Indian Computer Emergency Response Team), established under Section 70B of the Information Technology Act, 2000, is the national nodal agency for incident response. In April 2022 CERT-In issued directions requiring entities to report specified cyber incidents within six hours of detection and to retain logs for 180 days, a high-yield fact for Prelims.
The statutory backbone is the IT Act, 2000 (amended 2008, which inserted Section 66F on cyber-terrorism and Section 43A on data protection). Critical Information Infrastructure (CII)—systems whose incapacitation would debilitate national security—is protected under Section 70, with the National Critical Information Infrastructure Protection Centre (NCIIPC) designated as nodal agency under the National Technical Research Organisation (NTRO).
The coordinating layer
The National Cyber Security Coordinator (NCSC) sits in the National Security Council Secretariat and coordinates across agencies. The Indian Cyber Crime Coordination Centre (I4C) under the Ministry of Home Affairs runs the National Cyber Crime Reporting Portal and the citizen helpline 1930. The Defence Cyber Agency, operational since 2019, handles military cyber operations as a tri-service body.
For data governance, the Digital Personal Data Protection Act, 2023 replaced the Section 43A regime, creating obligations on Data Fiduciaries and a Data Protection Board; its enforcement rules were under finalisation through 2024–25. Candidates must distinguish the DPDP Act (privacy) from CERT-In directions (incident response) and from the NCIIPC mandate (infrastructure).
Dated instances to retain
Name concrete cases in answers. The 2017 WannaCry ransomware affected systems globally including in India. In October 2019, malware (later attributed to North Korea-linked actors) was detected on the administrative network of the Kudankulam Nuclear Power Plant, illustrating CII vulnerability. In October 2020, a grid disturbance in Mumbai prompted scrutiny of possible cyber intrusion into power infrastructure. The AIIMS Delhi ransomware attack of November 2022 crippled hospital services for days, demonstrating healthcare-sector exposure. India's evolving posture is captured in the National Cyber Security Policy, 2013, with a successor National Cyber Security Strategy long anticipated.
The exam rewards the ability to connect supply-chain risk (telecom equipment, the 2021 'trusted source' regime for telecom under the National Security Directive on the Telecommunication Sector) to strategic autonomy. Note also the Telecommunications Act, 2023, which modernised the colonial-era framework and addresses interception and security of networks. A precise answer names the statute, the section and the year—never a vague reference to 'cyber laws'.
