Subject: Internal Security

Why in the News?

In January, the Kaveri 2.0 web portal, which helps with property registrations in Karnataka, experienced frequent server crashes. This caused a major disruption, bringing property registration and related citizen services to a near halt in the state.

What are other major DDoS attacks?

• Dyn DDoS Attack (2016): The Dyn DDoS attack disrupted major websites including Twitter, Netflix, and Reddit. The attack used a botnet of IoT devices, such as cameras and routers, to flood Dyn’s servers with traffic, causing widespread outages.
• GitHub DDoS Attack (2018): In 2018, GitHub was hit by one of the largest DDoS attacks in history, with traffic peaking at 1.35 terabits per second. The attack exploited memcached servers to amplify the traffic, overwhelming GitHub’s servers before mitigation efforts kicked in.
• AWS DDoS Attack (2020): Amazon Web Services (AWS) faced a 2.3 Tbps DDoS attack in 2020, which was one of the largest publicly reported DDoS attacks. AWS mitigated the attack using its cloud infrastructure and security services like AWS Shield.
• Cloudflare DDoS Attack (2021): In 2021, Cloudflare thwarted a 26 million request-per-second DDoS attack, one of the largest HTTPS DDoS attacks at the time. It was mitigated using Cloudflare’s advanced rate-limiting and traffic filtering technologies.
• Microsoft Azure DDoS Attack (2023): Microsoft Azure faced one of the largest DDoS attacks ever recorded, peaking at 3.47 terabits per second. The attack, attributed to a botnet leveraging vulnerable devices, aimed to disrupt services for enterprise clients.

How can such attacks be mitigated? (Way forward)

• Traffic Filtering & AI-Based Detection: Uses firewalls, intrusion detection systems (IDS), and AI-based threat analysis to filter out malicious traffic before it reaches the target server.
  • Example: Google Cloud Armor helped mitigate a 46 million request-per-second (RPS) DDoS attack in 2022 by detecting abnormal traffic patterns and blocking it in real-time.
• Rate Limiting & Load Balancing: Restricts the number of requests a user can make in a given timeframe and distributes traffic across multiple servers to prevent overload.
  • Example: Cloudflare’s Rate Limiting and Load Balancer mitigated an HTTP flood attack on a European banking institution, ensuring legitimate users were not affected.
• Bot Detection & CAPTCHAs: Uses CAPTCHA tests, behavioural analytics, and browser fingerprinting to block automated bot traffic.
  • Example: GitHub (2015 DDoS Attack by China-based botnet) introduced CAPTCHA-based protection to prevent automated malicious requests targeting anti-censorship tools.
• CDN & Cloud-Based DDoS Protection: Content Delivery Networks (CDNs) and cloud-based security providers absorb attack traffic before it reaches the main infrastructure.
  • Example: Amazon AWS Shield protected against a 2.3 Tbps DDoS attack (2020) by leveraging global CDN distribution and real-time attack mitigation.
• Incident Response Plan & Collaboration with Cybersecurity Agencies: Organizations monitor threats, conduct regular security audits, and coordinate with government agencies for rapid response.
  • Example: Kaveri 2.0 Attack (2024, Karnataka, India) led to a cybercrime investigation and strengthened security protocols after the portal faced 6.2 lakh malicious requests in two hours.

Mains PYQ:

Q Discuss the potential threats of Cyber attack and the security framework to prevent it.(UPSC IAS/2017)

Why in the News?

Kaveri 2.0, a web portal launched in 2023 to make property registrations in Karnataka easier was recently hit by a DDoS attack carried out using AI-powered bots.

What are the key issues with Karnataka’s response to cyber attacks, specifically the DDoS attack on Kaveri 2.0?

• Lack of Proactive Cybersecurity Measures: Despite previous cyber incidents like the 2017 WannaCry ransomware attack and the 2019 e-procurement portal hack, the State failed to implement robust preventive measures. The DDoS attack on Kaveri 2.0 in December 2024 – February 2025 exposed the absence of real-time threat monitoring systems.
• Poor Coordination Between Departments: The e-Governance Department did not involve the State cyber crime police until February 7, 2025, despite weeks of disruption. Resistance within departments to share cybersecurity concerns with law enforcement delayed incident response, worsening the crisis.
• Lack of a Dedicated Cybersecurity Infrastructure: Karnataka lacks a Cyber Security Operation Centre like Maharashtra and Odisha. A ₹20 crore cybersecurity centre, proposed in February 2023, was scrapped after the new government took over, leaving critical digital infrastructure vulnerable.
• Government Response and Security Measures: While the government has initiated a police probe and FIR registration under the Information Technology Act, and the Kaveri 2.0 application has been restored with enhanced security measures,
  • Karnataka launched a cyber security policy in 2024 to combat rising cybercrime, focusing on awareness, skill building, and industry promotion.

How have past attacks influenced the current state of cyber security?

• Failure to Implement Robust Cybersecurity Measures: Despite the 2017 WannaCry ransomware attack on the Karnataka State Data Centre and the 2019 e-Procurement portal hack (₹11.5 crore stolen), the state did not establish strong preventive mechanisms.
  • The lack of a dedicated Cyber Security Operation Centre resulted in inadequate monitoring and delayed responses to threats like the recent DDoS attack on Kaveri 2.0 (2024-25).
• Persistent Coordination Gaps Between Departments: Earlier attacks, such as the 2022 cyber attack on NIMHANS, highlighted poor inter-departmental coordination, yet similar gaps persisted during the Kaveri 2.0 DDoS attack.
  • The e-Governance Department handled the crisis alone without informing the cyber crime police, delaying investigative action until February 7, 2025.
• Neglect of Cybersecurity Infrastructure Development: A ₹20 crore Cyber Security Operation Centre, proposed in February 2023, was dropped in the May 2023 budget revision after a change in government.
  • Unlike Maharashtra and Odisha, which have dedicated cyber security setups, Karnataka still lacks a real-time threat detection system, leaving it vulnerable to repeated cyber attacks.

Why has the coordination between the e-Governance Department and the State Police been ineffective during cyber incidents?

• Lack of a Unified Cybersecurity Framework: Karnataka’s Cyber Security Committee (2023) is led by bureaucrats without police representation, unlike national-level bodies like I4C (Indian Cyber Crime Coordination Centre) and NCIIPC (National Critical Information Infrastructure Protection Centre).
  • This results in fragmented decision-making, where cybersecurity response remains within the e-Governance Department, sidelining law enforcement agencies.
• Delayed Involvement of the Cyber Crime Police: In the Kaveri 2.0 DDoS attack (2024-25), the e-Governance Department did not inform the State cyber crime police until February 7, 2025—long after the attack began in December 2024.
  • Earlier incidents like the 2019 e-Procurement portal hack and 2022 NIMHANS cyber attack also saw delayed police involvement, allowing attackers more time to operate.
• Departmental Hesitation to Engage Law Enforcement: Sources indicate a reluctance within the e-Governance Department to involve the police, possibly due to bureaucratic hurdles or fears of administrative scrutiny.
  • This lack of trust and procedural clarity has led to independent firefighting efforts rather than a coordinated response between technical teams and law enforcement.

Why is it crucial for the state to establish a Cyber Security Operation Centre similar to the national model?

• Real-Time Threat Detection and Response: The DDoS attack on Kaveri 2.0 (2024-25) went undetected for weeks, causing major disruptions in property registrations. A Cyber Security Operation Centre (CSOC) would enable 24/7 monitoring and early detection of cyber threats.
  • National agencies like I4C (Indian Cyber Crime Coordination Centre) and NCIIPC (National Critical Information Infrastructure Protection Centre) use AI-driven analytics and real-time threat intelligence to mitigate cyber risks, a model Karnataka must adopt.
• Coordinated and Rapid Incident Response: Karnataka’s e-Governance Department handled the Kaveri 2.0 attack alone, only involving cyber crime police weeks later, delaying mitigation efforts.
  • A CSOC would centralize cybersecurity efforts, ensuring immediate coordination between technical experts, government departments, and law enforcement agencies to prevent prolonged disruptions.

Way forward: 

• Establish a Cyber Security Operation Centre (CSOC): Revive the ₹20 crore CSOC proposal with real-time threat monitoring, AI-driven analytics, and centralized coordination between government agencies and law enforcement.
  • Implement automated response mechanisms to detect and neutralize cyber threats before they escalate.
• Strengthen Inter-Departmental Coordination and Cybersecurity Framework: Mandate immediate police involvement in cyber incidents and integrate law enforcement into cybersecurity governance structures like the Cyber Security Committee.
  • Conduct joint cybersecurity drills between the e-Governance Department, State Police, and IT experts to improve incident response efficiency.

Mains PYQ:

Q What are the different elements of cyber security? Keeping in view the challenges in cyber security, examine the extent to which India has successfully developed a comprehensive National Cyber Security Strategy. (UPSC IAS/2022)