The recent notification, issued under the Allocation of Business Rules, 1961, assigns specific roles to different ministries: the Ministry of Communication oversees telecom security
The Indian government’s recent notification dated September 27, which outlines the roles of various ministries in telecom security, cybersecurity, and cybercrime, aims to clarify responsibilities. However, a major concern looms: the lack of a coordinated approach to address the increasingly interconnected world of cyber threats. This gap could prove costly in times of national cyber emergencies, where fast decision-making and clear command structures are essential.
Cybersecurity & Cybercrime: Two Sides Of Same Coin
Cybersecurity and cybercrime are closely intertwined. While cybersecurity involves protecting networks, systems, and data from unauthorized access, cybercrime exploits vulnerabilities in these areas for illegal purposes. Both concepts influence one another—stronger cybersecurity reduces cybercrime opportunities, but advancing cybercriminal tactics necessitate continuous updates to cybersecurity measures. Under Indian law, even attempting to breach cybersecurity is considered a cybercrime.
Call For Centralised Cyber Command
The recent notification, issued under the Allocation of Business Rules, 1961, assigns specific roles to different ministries: the Ministry of Communication oversees telecom security, the Ministry of Electronics and Information Technology (MeitY) handles cybersecurity, and the Ministry of Home Affairs (MHA) is responsible for cybercrime. While these roles are now defined, the notification does not address how these ministries will coordinate during a national cyber emergency.
A recent ransomware attack on the All India Institute of Medical Sciences (AIIMS) exposed a critical weakness in coordination among different agencies. Multiple bodies—including the Ministry of Communication, MeitY, MHA, Delhi Police, and the National Security Council Secretariat (NSCS)—were involved in responding to the attack. However, without a central authority leading the efforts, the response was fragmented and delayed.
The government’s notification lacks a framework for how these agencies should work together in such situations. Without a central command, India risks bottlenecks during times when quick, coordinated action is crucial.
Crime As State Subject: A Jurisdictional Challenge
In India, crime is primarily a state subject, meaning state governments and their police forces are responsible for investigations within their borders. This creates complications when it comes to cybercrime, where the lines of authority between state and central agencies are not always clear. While MHA oversees cybercrime at the national level, it cannot directly issue instructions to state police forces during investigations.
This division raises an important question: how will central agencies and state law enforcement work together during a large-scale cyberattack that requires joint efforts? The recent notification does not offer solutions to this problem, leaving a significant gap in India’s cybersecurity framework.
Overlapping Responsibilities: Who Leads Response?
According to the notification, CERT-In (Indian Computer Emergency Response Team) under MeitY is responsible for monitoring cybersecurity threats, while the Department of Telecommunications (DoT) handles telecom security and the MHA deals with cybercrime. However, there is no mention of how these agencies will collaborate with state police during investigations, which is vital since any attempted cyber breach is classified as a crime under Indian law and falls under the jurisdiction of state police.
This lack of communication has been an issue in the past, with CERT-In and the Telecom Ministry often failing to inform state authorities when breaches are detected. Without proper coordination, attackers could exploit these gaps, making it harder for state police to carry out effective investigations.
NCIIPC: Critical Oversight
One glaring omission in the notification is the absence of the National Critical Information Infrastructure Protection Centre (NCIIPC), the body responsible for protecting India’s critical infrastructure, such as power grids and financial systems. Given the increasing cyber threats to such infrastructure, NCIIPC’s role is crucial, yet the notification does not address how it will coordinate with other ministries during a crisis.
This raises concerns about how NCIIPC would work alongside CERT-In, MeitY, DoT, or MHA when a cyberattack threatens critical infrastructure. Without a clear framework, India’s response to a major cyber crisis could be fragmented and inefficient.
Delays In Decision-Making
In the event of a significant cyberattack, having multiple agencies working independently could lead to jurisdictional conflicts and delays in crucial decision-making. For example, during the AIIMS ransomware attack, different investigating agencies from both the state and central governments were involved. The absence of an overarching command not only delayed the response but also created confusion among the agencies, leaving the hospital’s systems crippled for days.
Similarly, if a cyberattack affects both telecom infrastructure and sensitive data, it is unclear how the Ministry of Communication and MeitY would collaborate, or which agency would take the lead. When the attack is also a criminal matter, MHA’s role would become significant. Yet, the notification fails to outline how these ministries will work together in real-time when time is of the essence.
The Way Forward: A Unified Cybercrime Investigation Authority
To overcome these challenges, India needs a central authority to handle cybercrime investigations and ensure seamless coordination among various agencies. This central body would streamline processes, particularly when investigations require international cooperation or involve interstate coordination.
As cyber threats become more sophisticated, India’s approach to cybersecurity must evolve. While the recent notification clarifies roles, what the country truly needs is a unified command structure—a central authority capable of coordinating all stakeholders during a cyber crisis. The National Security Council Secretariat (NSCS) could potentially take on this role, but it must be empowered to issue commands and make decisions during national cyber emergencies.
India has made progress in building its cybersecurity infrastructure, but the gaps in inter-departmental coordination remain. The next major cyber crisis could occur at any moment, and when it does, we cannot afford to have ministries working in isolation. Moving beyond assigning responsibilities to establishing a structure for seamless collaboration is critical to ensuring national cybersecurity.
