Beyond Kudankulam’s fence, a cybersecurity challenge

Why in the News

A breach of Kudankulam nuclear power project files in Tamil Nadu shows that cyber risk to critical infrastructure now lies with contractors and data centres beyond the plant’s perimeter. India’s rules bind only the operator, so data shared across the supply chain falls into an accountability gap.

What happened in the Kudankulam breach?

1. The leak: In mid-July, the group World Leaks posted parts of nearly 19,000 allegedly leaked Kudankulam files, including engineering drawings and supplier information, on its dark web portal.
2. Contractor’s server: Reliance Infrastructure, the construction contractor for Units 3 and 4, confirmed the breach. The data sat on a server at its third-party data centre, Yotta.
3. Ransomware attack: Yotta confirmed ransomware (malicious software that locks or steals data to extort payment) activity on May 29. By June the attackers were demanding a ransom.
4. Operator’s position: The Nuclear Power Corporation of India Limited (NPCIL) said the files concerned only non-nuclear infrastructure. Nothing public shows the Internet-isolated reactors or safety systems were accessed.
5. The takeaway: The reactors were not reached, so the real issue is how much operationally useful information about sensitive facilities sits outside them.

Why is this a repeat of 2019?

1. Dtrack malware: In 2019, malware that researchers link to North Korea’s Lazarus Group was found on a computer on the plant’s Internet-facing administrative network.
2. NPCIL’s response then: It dismissed the reports, then confirmed the infection, stressing that the critical internal network stayed isolated.
3. Common pattern: In both cases the core held and the exposure came at the periphery. The 2019 lesson was never applied systematically to contractors and suppliers.

Why does the supply chain create a cyber blind spot?

1. Many hands on sensitive data: A nuclear plant or power grid involves builders, suppliers, cloud providers, insurers, certifiers and subcontractors, many of them foreign partners.
2. Safeguards stop at the gate: Data held by these firms lacks the plant’s network segmentation (walling network parts off), air-gapped control systems (cut off from outside networks) and physical security.
3. Attacker’s roadmap: Such documents help an attacker pick phishing targets (staff to trick with fake messages) and the weakest subcontractor. They can also reveal how systems are accessed.
4. Expanding exposure: Private access is widening as Kudankulam expands to 6,000 MW, smart grids spread, Atmanirbhar Bharat opens defence and space to private firms, and government data moves to commercial clouds.

Where does India’s cyber governance fall short?

1. Existing institutions: The Indian Computer Emergency Response Team (CERT-In), the national incident response agency, made prompt incident reporting mandatory in 2022. The National Critical Information Infrastructure Protection Centre (NCIIPC) protects critical systems.
2. Operator-only obligations: NCIIPC works under Section 70A of the Information Technology Act, 2000. Its “protected system” status places duties on the operator alone, so data passed to a contractor is protected only by contracts.
3. Data law gap: The Digital Personal Data Protection Act, 2023 does not generally cover engineering drawings and technical data that carry no personal data.
4. Accountability gap: The operator says its systems held, the contractor blames its host, and the host blames the malware, yet documents still reach the dark web.

Challenges

1. Supply chain attacks: Attackers exploit trusted vendors to enter many organisations at once. Eg. The Central Board of Secondary Education (CBSE) OnMark portal.
2. State-sponsored threats: Foreign state-linked groups target critical sectors. Eg. APT41, a China-linked group, targeted Indian telecom and power grids.
3. Ransomware extortion: Criminal groups steal or lock data and demand payment, often inflating what they hold.

Way Forward

1. Obligations follow the data: Bind every contractor and cloud provider handling critical infrastructure data to defined standards, with liability and audit terms in procurement contracts.
2. Data classification: Let a contractor hold only the data it needs, and only for as long as needed.
3. Third-party risk assessment: Replace annual compliance certificates with vendor assessments, including red-team exercises (simulated attacks).
4. Zero-trust architecture: Treat no network as safe and verify every access point on projects of national importance.
5. Single national framework: CERT-In, NCIIPC, sectoral regulators and operators should agree one supply chain security framework that fixes responsibility before a breach.

Conclusion

Critical infrastructure now has many access points outside the operator’s control, yet India’s rules still guard only the operator. The test is whether every organisation holding a facility’s secrets is held to the standard those secrets deserve.

Government Initiatives for Cyber Security

1. National Cyber Security Coordinator: Coordinates cyber agencies and advises the Prime Minister’s Office on cyber strategy.
2. Cyber Swachhta Kendra: Cleans botnets (networks of infected devices) and offers free malware removal tools.

Matching Previous Year Question

“[2022, GS3, 10 marks] What are the different elements of cyber security? Keeping in view the challenges in cyber security, examine the extent to which India has successfully developed a comprehensive National Cyber Security Strategy.”