GS Paper: Cyber Security

Why in the News?

In January, the Kaveri 2.0 web portal, which helps with property registrations in Karnataka, experienced frequent server crashes. This caused a major disruption, bringing property registration and related citizen services to a near halt in the state.

What are other major DDoS attacks?

• Dyn DDoS Attack (2016): The Dyn DDoS attack disrupted major websites including Twitter, Netflix, and Reddit. The attack used a botnet of IoT devices, such as cameras and routers, to flood Dyn’s servers with traffic, causing widespread outages.
• GitHub DDoS Attack (2018): In 2018, GitHub was hit by one of the largest DDoS attacks in history, with traffic peaking at 1.35 terabits per second. The attack exploited memcached servers to amplify the traffic, overwhelming GitHub’s servers before mitigation efforts kicked in.
• AWS DDoS Attack (2020): Amazon Web Services (AWS) faced a 2.3 Tbps DDoS attack in 2020, which was one of the largest publicly reported DDoS attacks. AWS mitigated the attack using its cloud infrastructure and security services like AWS Shield.
• Cloudflare DDoS Attack (2021): In 2021, Cloudflare thwarted a 26 million request-per-second DDoS attack, one of the largest HTTPS DDoS attacks at the time. It was mitigated using Cloudflare’s advanced rate-limiting and traffic filtering technologies.
• Microsoft Azure DDoS Attack (2023): Microsoft Azure faced one of the largest DDoS attacks ever recorded, peaking at 3.47 terabits per second. The attack, attributed to a botnet leveraging vulnerable devices, aimed to disrupt services for enterprise clients.

How can such attacks be mitigated? (Way forward)

• Traffic Filtering & AI-Based Detection: Uses firewalls, intrusion detection systems (IDS), and AI-based threat analysis to filter out malicious traffic before it reaches the target server.
  • Example: Google Cloud Armor helped mitigate a 46 million request-per-second (RPS) DDoS attack in 2022 by detecting abnormal traffic patterns and blocking it in real-time.
• Rate Limiting & Load Balancing: Restricts the number of requests a user can make in a given timeframe and distributes traffic across multiple servers to prevent overload.
  • Example: Cloudflare’s Rate Limiting and Load Balancer mitigated an HTTP flood attack on a European banking institution, ensuring legitimate users were not affected.
• Bot Detection & CAPTCHAs: Uses CAPTCHA tests, behavioural analytics, and browser fingerprinting to block automated bot traffic.
  • Example: GitHub (2015 DDoS Attack by China-based botnet) introduced CAPTCHA-based protection to prevent automated malicious requests targeting anti-censorship tools.
• CDN & Cloud-Based DDoS Protection: Content Delivery Networks (CDNs) and cloud-based security providers absorb attack traffic before it reaches the main infrastructure.
  • Example: Amazon AWS Shield protected against a 2.3 Tbps DDoS attack (2020) by leveraging global CDN distribution and real-time attack mitigation.
• Incident Response Plan & Collaboration with Cybersecurity Agencies: Organizations monitor threats, conduct regular security audits, and coordinate with government agencies for rapid response.
  • Example: Kaveri 2.0 Attack (2024, Karnataka, India) led to a cybercrime investigation and strengthened security protocols after the portal faced 6.2 lakh malicious requests in two hours.

Mains PYQ:

Q Discuss the potential threats of Cyber attack and the security framework to prevent it.(UPSC IAS/2017)

Why in the News?

Kaveri 2.0, a web portal launched in 2023 to make property registrations in Karnataka easier was recently hit by a DDoS attack carried out using AI-powered bots.

What are the key issues with Karnataka’s response to cyber attacks, specifically the DDoS attack on Kaveri 2.0?

• Lack of Proactive Cybersecurity Measures: Despite previous cyber incidents like the 2017 WannaCry ransomware attack and the 2019 e-procurement portal hack, the State failed to implement robust preventive measures. The DDoS attack on Kaveri 2.0 in December 2024 – February 2025 exposed the absence of real-time threat monitoring systems.
• Poor Coordination Between Departments: The e-Governance Department did not involve the State cyber crime police until February 7, 2025, despite weeks of disruption. Resistance within departments to share cybersecurity concerns with law enforcement delayed incident response, worsening the crisis.
• Lack of a Dedicated Cybersecurity Infrastructure: Karnataka lacks a Cyber Security Operation Centre like Maharashtra and Odisha. A ₹20 crore cybersecurity centre, proposed in February 2023, was scrapped after the new government took over, leaving critical digital infrastructure vulnerable.
• Government Response and Security Measures: While the government has initiated a police probe and FIR registration under the Information Technology Act, and the Kaveri 2.0 application has been restored with enhanced security measures,
  • Karnataka launched a cyber security policy in 2024 to combat rising cybercrime, focusing on awareness, skill building, and industry promotion.

How have past attacks influenced the current state of cyber security?

• Failure to Implement Robust Cybersecurity Measures: Despite the 2017 WannaCry ransomware attack on the Karnataka State Data Centre and the 2019 e-Procurement portal hack (₹11.5 crore stolen), the state did not establish strong preventive mechanisms.
  • The lack of a dedicated Cyber Security Operation Centre resulted in inadequate monitoring and delayed responses to threats like the recent DDoS attack on Kaveri 2.0 (2024-25).
• Persistent Coordination Gaps Between Departments: Earlier attacks, such as the 2022 cyber attack on NIMHANS, highlighted poor inter-departmental coordination, yet similar gaps persisted during the Kaveri 2.0 DDoS attack.
  • The e-Governance Department handled the crisis alone without informing the cyber crime police, delaying investigative action until February 7, 2025.
• Neglect of Cybersecurity Infrastructure Development: A ₹20 crore Cyber Security Operation Centre, proposed in February 2023, was dropped in the May 2023 budget revision after a change in government.
  • Unlike Maharashtra and Odisha, which have dedicated cyber security setups, Karnataka still lacks a real-time threat detection system, leaving it vulnerable to repeated cyber attacks.

Why has the coordination between the e-Governance Department and the State Police been ineffective during cyber incidents?

• Lack of a Unified Cybersecurity Framework: Karnataka’s Cyber Security Committee (2023) is led by bureaucrats without police representation, unlike national-level bodies like I4C (Indian Cyber Crime Coordination Centre) and NCIIPC (National Critical Information Infrastructure Protection Centre).
  • This results in fragmented decision-making, where cybersecurity response remains within the e-Governance Department, sidelining law enforcement agencies.
• Delayed Involvement of the Cyber Crime Police: In the Kaveri 2.0 DDoS attack (2024-25), the e-Governance Department did not inform the State cyber crime police until February 7, 2025—long after the attack began in December 2024.
  • Earlier incidents like the 2019 e-Procurement portal hack and 2022 NIMHANS cyber attack also saw delayed police involvement, allowing attackers more time to operate.
• Departmental Hesitation to Engage Law Enforcement: Sources indicate a reluctance within the e-Governance Department to involve the police, possibly due to bureaucratic hurdles or fears of administrative scrutiny.
  • This lack of trust and procedural clarity has led to independent firefighting efforts rather than a coordinated response between technical teams and law enforcement.

Why is it crucial for the state to establish a Cyber Security Operation Centre similar to the national model?

• Real-Time Threat Detection and Response: The DDoS attack on Kaveri 2.0 (2024-25) went undetected for weeks, causing major disruptions in property registrations. A Cyber Security Operation Centre (CSOC) would enable 24/7 monitoring and early detection of cyber threats.
  • National agencies like I4C (Indian Cyber Crime Coordination Centre) and NCIIPC (National Critical Information Infrastructure Protection Centre) use AI-driven analytics and real-time threat intelligence to mitigate cyber risks, a model Karnataka must adopt.
• Coordinated and Rapid Incident Response: Karnataka’s e-Governance Department handled the Kaveri 2.0 attack alone, only involving cyber crime police weeks later, delaying mitigation efforts.
  • A CSOC would centralize cybersecurity efforts, ensuring immediate coordination between technical experts, government departments, and law enforcement agencies to prevent prolonged disruptions.

Way forward: 

• Establish a Cyber Security Operation Centre (CSOC): Revive the ₹20 crore CSOC proposal with real-time threat monitoring, AI-driven analytics, and centralized coordination between government agencies and law enforcement.
  • Implement automated response mechanisms to detect and neutralize cyber threats before they escalate.
• Strengthen Inter-Departmental Coordination and Cybersecurity Framework: Mandate immediate police involvement in cyber incidents and integrate law enforcement into cybersecurity governance structures like the Cyber Security Committee.
  • Conduct joint cybersecurity drills between the e-Governance Department, State Police, and IT experts to improve incident response efficiency.

Mains PYQ:

Q What are the different elements of cyber security? Keeping in view the challenges in cyber security, examine the extent to which India has successfully developed a comprehensive National Cyber Security Strategy. (UPSC IAS/2022)

Why in the News?

India has started leveraging AI to bolster its defence ecosystem, but significant challenges remain.

What are the strategic implications of AI integration in India’s defence?

• Enhanced Military Capabilities: The integration of AI is expected to revolutionize military operations through improved predictive analytics, autonomous decision-making systems, and advanced operational efficiency.
• Modernization Focus: With a defence budget of ₹6.21 lakh crore ($75 billion) for 2023-24, India is prioritizing modernization efforts, including the development of innovative products like the Indrajaal autonomous drone security system.
• Global Competitiveness: To keep pace with countries like Israel and China that have rapidly advanced their military AI capabilities, India recognises the need for a clear vision and strategy for AI deployment in defence.

How does India plan to overcome challenges in implementing AI in military operations?

• Funding and Infrastructure: A significant barrier to effective AI integration is the high cost of data centres and the infrastructure necessary for running advanced AI systems. The military’s focus on replacing outdated legacy systems adds to financial pressures.
• Fragmented Policies: India’s current policies regarding AI deployment are often fragmented, lacking comprehensive guidelines specifically tailored for military applications. Existing frameworks do not adequately address accountability and transparency in military AI use.
• Inter-Service Silos: The historically siloed nature of the Indian Armed Forces—where the Army, Navy, and Air Force operate independently—hinders interoperability and complicates joint operations.

What role does collaboration between the public and private sectors play in advancing AI in defence?

• Public-Private Partnerships (PPPs): To enhance technological advancements in defence, India needs to foster collaboration between public sector units (PSUs) and private entities. This approach can leverage the innovation capabilities of startups and private companies.
• Knowledge Sharing: Collaborations with foreign tech giants like Microsoft, which has committed approximately $3 billion to develop data centres in India, can facilitate knowledge transfer and resource sharing essential for building a robust AI ecosystem.
• Accelerating Innovation: Engaging private sector expertise can lead to faster development cycles and more effective deployment of AI technologies within the military framework.

Way forward: 

• Strengthen Policy Frameworks and Coordination: Develop cohesive and actionable policies for AI deployment in defence, focusing on inter-service interoperability, accountability, and transparency while operationalizing bodies like DAIC and DAIPA effectively.
• Promote Public-Private Collaboration: Enhance public-private partnerships (PPPs) to leverage private innovation and attract foreign investments, ensuring resource optimization and accelerated AI adoption in military operations.

Mains PYQ:

Q Discuss different types of cyber crimes and measures required to be taken to fight the menace. (UPSC IAS/2020)

Why in the News?

The US court ruling found the maker of Pegasus spyware guilty of hacking WhatsApp, while in India, the investigation ended quietly without any results.

What are the implications of the US court ruling against NSO Group?

• Legal Accountability Established: The US District Court’s ruling that NSO Group is liable for hacking WhatsApp users marks a significant legal precedent. It affirms that private companies engaged in illegal surveillance can be held accountable in a court of law, which may encourage other jurisdictions to take similar actions against such entities.
• Protection of Privacy Rights: The ruling underscores the importance of user privacy and proprietary technology protection. It emphasizes that courts can act decisively to safeguard individual rights against corporate malfeasance, setting a standard for privacy protection that could influence global norms.
• Pressure on NSO Group: The verdict amplifies economic and operational pressures on NSO Group, potentially leading to stricter regulations and oversight of surveillance technology firms worldwide. This could deter similar future actions by other companies in the industry.

Why has India’s inquiry into the Pegasus allegations been ineffective?

• Government Evasion: The Indian government’s refusal to confirm or deny the use of Pegasus spyware has significantly hampered any meaningful investigation. This silence has been framed as a matter of national security but is perceived as a deliberate evasion of accountability.
• Lack of Cooperation: The Supreme Court’s appointed committee faced challenges due to the government’s lack of cooperation.
  • Key stakeholders like WhatsApp and Apple were not compelled to provide evidence or testimony, limiting the committee’s ability to draw conclusive findings.
• Judicial Delays and Inaction: India’s judicial system is plagued by delays and inefficiencies, which have further stalled inquiries into Pegasus. Parliamentary debates have devolved into unproductive exchanges, failing to generate actionable outcomes.

What should be the next steps for Indian authorities following the US verdict? (Way forward)

• Reinitiate Investigations: Indian authorities should consider reopening investigations into Pegasus with renewed vigour, leveraging insights from the US court ruling. This includes calling for transparency from technology companies involved in the case.
• Engage with Stakeholders: Authorities should actively engage with WhatsApp, Apple, and other relevant parties to gather comprehensive evidence regarding the spyware’s use in India. This collaboration is crucial for establishing accountability.
• Legislative Reforms: There is an urgent need for systemic reforms in surveillance laws and practices in India. Authorities should work towards creating robust frameworks that protect citizens’ privacy rights and establish clear guidelines for state surveillance activities.
• Public Disclosure: To rebuild public trust, it is essential for the government to disclose findings from previous inquiries and commit to transparency moving forward. This includes making reports from technical committees publicly available

Mains PYQ:

Q Discuss different types of cyber crimes and measures required to be taken to fight the menace. (UPSC IAS/2020)