India’s NSCS Steps Up to Enhance Cybersecurity Oversight and Manage Emerging Risks

India is enhancing its cybersecurity framework as the National Security Council Secretariat (NSCS) steps up oversight to tackle escalating digital threats through coordinated governmental structures and legislative improvements.

Short Summary:

• NSCS is tasked with increasing cybersecurity governance across various ministries in response to rising digital threats.
• The Indian government is revising existing cybersecurity frameworks to address modern challenges, including coordination failures among departments.
• Significant incidents, such as the AIIMS ransomware attack, highlight the urgent need for a centralized cyber command.

The digital age has ushered in an era of unprecedented challenges, especially in cybersecurity. With the rapid expansion of India’s digital ecosystem, evidenced by the growth during the pandemic, outdated regulatory mechanisms are struggling to keep pace with emerging threats. The government’s recent notification on September 27, aimed at clarifying the roles of key ministries in cybersecurity, marks a crucial step in addressing these complex issues. However, it also reveals significant gaps, particularly in inter-agency coordination, which could jeopardize national security in the event of a cyber crisis.

Current State of India’s Cybersecurity Framework

India’s cybersecurity landscape is complex, governed by multiple laws and agencies tasked with managing cyber threats. The primary legislative framework remains the Information Technology Act, 2000, which has undergone several amendments, including the latest provisions introduced in the Digital Personal Data Protection Act of 2023. Despite these efforts, there is an observable fragmentation in governance, leading to confusion and ineffective responses during cyber incidents.

“The effectiveness of cybersecurity defines the success of defending against cybercrime.” – Source

As highlighted by Prof. Triveni Singh, former IPS, while the notification brings some clarity regarding the roles of the Ministry of Electronics and Information Technology (MeitY) and the Ministry of Home Affairs (MHA), it remains unclear how these ministries will collaborate effectively during emergencies. This lack of a cohesive strategy was glaringly evident during the recent ransomware attack on the All India Institute of Medical Sciences (AIIMS), which exposed the vulnerabilities rooted in the absence of a unified command and oversight structure.

The Need for a Central Cyber Command

Establishing a centralized cyber command structure is essential for effective cybersecurity management. Events such as the AIIMS attack witnessed multiple agencies attempting to handle the situation independently, leading to delays and miscommunication. The absence of a singular authority capable of directing resources efficiently during a crisis poses a significant risk to public safety and wellbeing.

“Without a central agency acting as the nodal authority, India risks a bureaucratic bottleneck when swift action is needed most.” – Source

The recent cabinet notification, designated to streamline responsibilities, still underlines a major flaw: the lack of coordination between state authorities and central agencies. In a federal structure where crime investigation is largely a state subject, how will these entities effectively collaborate during a national cyber incident? This is a question the new framework fails to adequately answer, leaving states and the MHA to operate under ambiguous jurisdiction during crises.

Confusion Over Jurisdiction and Responsibilities

The division of responsibilities among various ministries complicates the cyber policing landscape. According to constitutional law, crime is managed at the state level, which creates hurdles when central agencies require state cooperation. This is especially troubling in cybercrime scenarios where multiple jurisdictions intersect.

“How will coordination happen in the event of a cyber attack that requires joint action from both central agencies and state law enforcement?” – Source

Compounding this issue, incidents like the AIIMS attack have shown that while agencies such as CERT-In, the Department of Telecommunications (DoT), and the MHA are tasked with specific roles, there’s inadequate provision in the notification concerning how these entities should interact during investigations. Most alarmingly, it has been observed that centralized agencies often fail to inform state law enforcement when cyber attacks are detected, leaving local forces unaware and unprepared.

The Oversight of the NCIIPC

Equally concerning is the omission of the National Critical Information Infrastructure Protection Centre (NCIIPC) from the government’s latest directive. This agency plays a pivotal role in safeguarding critical infrastructure, yet its absence from the notification raises red flags regarding overall strategy and coordination in cybersecurity governance. The NCIIPC is designed to respond to cyber threats against systems that, if compromised, could disrupt essential services across the nation.

“Without a clear framework, India’s cybersecurity response risks becoming fragmented and inefficient, particularly during major attacks on critical infrastructure.” – Source

The NCIIPC must coordinate with other ministries, yet the current cabinet notification doesn’t allocate a framework for this cooperation, potentially leading to inefficacies in crisis response. The country’s technological backbone, including sectors like power, finance, and transport, relies heavily on the NCIIPC’s strategic operations. If this center cannot function effectively alongside other ministries, the integrity of these sectors is put at risk.

Addressing Cyber Attacks: Who Takes Charge?

The delineation of responsibilities in addressing cybersecurity threats leaves key questions unaddressed: who leads the investigations, and how are resources allocated? These uncertainties became painfully clear during the AIIMS ransomware attack, where the multiple agencies involved operated without an overarching command structure.

“When a cyber attack affects both telecom infrastructure and sensitive data, it is not clear how the Ministry of Communication and MeitY would collaborate.” – Source

The recent cabinet notification consists of detailed ministerial assignments but neglects how these bodies will work together during a security incident. The assignment of roles without a formal collaborative procedure could lead to operational paralysis during critical moments.

The Proposal for a Unified Cybercrime Investigation Authority

In light of the growing sophistication and frequency of cyberattacks, there is an evident need for a central cybercrime investigation authority. Such an entity would facilitate communication between governmental bodies and streamline the response to cyber threats, especially when circumstances necessitate swift action involving different jurisdictions and sectors. It is critical for this authority to incorporate international cooperation, as cybercriminals frequently operate across borders, complicating investigations.

“Cybercrime is complex and often requires international cooperation to obtain digital evidence.” – Source

As the environment matures, so too must India’s approach to cybersecurity. Alongside defined responsibilities for each ministry, a centralized command could address the overlapping jurisdictions effectively, thereby enhancing national resilience to cyber threats. By entrusting the National Security Council Secretariat (NSCS) with this role, it could serve as an effective nodal authority in times of crisis, streamlining command execution during significant cyber incidents.

Moving Forward: Essential Reforms for Cybersecurity

To conclude, India stands at a crossroads in its approach to cybersecurity governance. The recent cabinet notification is a step in the right direction for clarifying roles and responsibilities, but without robust inter-departmental coordination, the effectiveness of these initiatives could be hindered. The AIIMS ransomware incident serves as a stark reminder of the vulnerabilities inherent in the fragmented approach of different agencies.

“The next major cyber crisis could be just around the corner, and we cannot afford to have our ministries working in silos.” – Source

To successfully navigate the complexities of modern cyber threats, India must embrace a more collaborative and unified approach. This means not only refining existing frameworks but also ensuring that the NCIIPC and CERT-In are integrated into a comprehensive strategy for national cybersecurity. India’s commitment to enhancing its cyber defenses can set a precedent for handling digital threats and fostering sustainable security for all stakeholders in its digital economy.