The government is considering granting enforcement powers to India’s nodal cybersecurity agency — similar to the approach taken by the US and EU — in the wake of an unprecedented increase in cyberattacks perpetrated by AI, officials familiar with the matter said.
The government is considering granting enforcement powers to India’s nodal cybersecurity agency — similar to the approach taken by the US and EU — in the wake of an unprecedented increase in cyberattacks perpetrated by AI, officials familiar with the matter said.Currently, the Indian Computer Emergency Response Team (CERT-In) issues advisories on cybersecurity threats, but those are not mandatory to be complied with.
“This could begin with government organisations being brought under a framework that legally ensures they comply with CERT-In instructions to patch critical vulnerabilities within fixed timeframes. There are some global precedents,” an official said.
Last month, two critical flaws in the PHP programming language, discovered with AI help, created worldwide panic.
Hackers targeting the vulnerabilities millions of times led to governments including the US, UK, France, Germany and Japan taking down public websites. PHP powers 69.3% of websites worldwide.
“Proposals to give the national agency more powers to issue binding directives to quickly meet cybersecurity crises have been discussed by policymakers earlier as well. But the latest PHP crisis has brought it to the fore,” the official said.
In India, CERT-In advised organisations to expeditiously apply security patches, but officials indicated this could not ensure complete compliance from government agencies running myriad, potentially affected, websites.
Thousands of state government portals, district administration websites, municipal corporation services and public grievance redressal systems in India have historically relied on content management systems and frameworks based on PHP. The National Portal of India links and provides access to more than 6,700 government websites.
Following the PHP scare, CERT-In held meetings with state computer security incident response teams and information technology departments, and prioritised critical areas such as health- and banking-related websites for patching, ET reported last week. However, experts warned that for India, the bigger problem was that legacy bank, telecom, power and even direct-to-consumer applications were running on older PHP versions, which have no fix, and patching on this scale could run until 2027.
“Enforceable powers being given to CERT-In will help since incident reporting also remains poor,” defence and cybersecurity policy analyst Subimal Bhattacharjee said. “The agency also needs significant budgetary and personnel enhancements. There also needs to be greater harmonisation in the way various government agencies and ministries coordinate on cybersecurity activities, and CERT-In needs to have greater involvement.”
Officials expect to discuss more ways to strengthen India’s public sector cyber capabilities after the release of the consultation paper on AI regulation, which the Ministry of Electronics and Information Technology (MeitY) is working on.
“CERT-In mandates empanelled security audits for government portals before they are launched. But these static checks may fail to catch zero-day flaws which are increasingly being unearthed by frontier AI models,” said one of the officials. “There is a need to see if continuous, automated vulnerability disclosure programmes should be run across government domains.”
The government is considering expanding the powers of the cybersecurity agency after tightening rules on incident reporting. Under the Digital Personal Data Protection regime, data fiduciaries or entities processing personal data need to intimate users “without delay” upon becoming aware of data breaches. A detailed report to the Data Protection Board of India should follow within 72 hours, failing which a penalty of up to ₹200 crore could be imposed.
Existing provisions
Officials said another possible way for CERT-In was to increase directions issued under Section 70B(6) of the Information Technology Act, 2000, which allows it to call for information and issue binding directions to service providers, intermediaries, data centres, body corporates and others.
Section 70B(7) lists out imprisonment of up to one year, a fine of up to ₹1 crore, or both, for failure to comply with these directions. CERT-In has used this provision very sparingly. A rare instance was the statutory directions issued in June 2022 mandating that Indian organisations must report 20 types of cybersecurity incidents within six hours of being aware of them, and maintain logs locally for up to 180 days.
“CERT-In doesn’t have a last-mile enforceability mechanism,” said Arjun Bhaskaran, managing director of Indo-Japanese business advisory and consulting firm Sanno Global.
