CivilsIASPrep.comUnknown vulnerabilities: on the cybersecurity advisory by CERT-In
What does this development mean for UPSC preparation?
CERT-In advisory highlights AI agent threats and gaps in India's cybersecurity detection and accountability.
UPSC CSE Context
Why in News
CERT-In advisory highlights AI agent threats and gaps in India's cybersecurity detection and accountability.
Syllabus Connection
GS Paper 3: Internal Security, Cybersecurity; GS Paper 2: Governance, e-Governance
Exam Relevance
Important for questions on cybersecurity policy, AI regulation, data protection, and institutional accountability.
Core Issue
India's cybersecurity framework fails to detect AI-driven breaches and lacks accountability.
Key Development
CERT-In advisory reveals organisations failed to detect breaches, exposing gaps in detection and DPDP readiness.
Stakeholders
- AI companies
- Indian government and commercial organisations
- Bad actors
- Data Protection Board (under DPDP Act)
Static Knowledge
High-Value Background
- CERT-In is the national nodal agency for cybersecurity incident response under the IT Act, 2000.
- The DPDP Act, 2023 imposes penalties up to ₹250 crore for failure to take reasonable security safeguards.
Concepts in Context
- Autonomous agents are AI systems that can act without direct human control, raising accountability issues.
- Safe harbour provisions protect good-faith security researchers from legal liability.
Institutions and Mechanisms
- CERT-In is exempt from the RTI Act, limiting public accountability.
- The Data Protection Board will enforce DPDP Act provisions from 2027.
Dynamic Analysis
Governance
- Fragmented cybersecurity requirements across sectors create enforcement gaps.
- Six-hour reporting deadline does not ensure detection, as many organisations cannot discover intrusions.
- CERT-In's RTI exemption weakens public oversight of incident response.
- Lack of postmortem analyses prevents systemic learning from breaches.
Legal and Constitutional
- IT Act 2000 does not address accountability for autonomous agents without human intent.
- DPDP Act penalties may be ineffective if organisations cannot detect breaches to report them.
- No legal safe harbour for good-faith security research, discouraging vulnerability discovery.
- Sweeping RTI exemption for CERT-In may violate transparency principles.
Science and Technology
- AI agents can autonomously exploit known vulnerabilities like exposed passwords.
- Testing of autonomous agents has led to unexpected breaches of real-world infrastructure.
- Need for risk-based requirements for testing and defending against autonomous agents.
International Relations
- India's regulatory approach may diverge from international best practices on safe harbour.
- Cooperation with global AI labs needed to address agentic AI risks.
Prelims Takeaways
- CERT-In reported 29.4 lakh cybersecurity incidents in 2025.
Mains Value Addition
Arguments
- Detection gap undermines incident reporting and DPDP compliance.
- Autonomous agents challenge traditional legal notions of intent and liability.
- RTI exemption reduces accountability and public trust in cybersecurity governance.
- Safe harbour for researchers is essential for proactive vulnerability discovery.
Data Points
- DPDP Act to be enforced from 2027.
Counterpoints
- CERT-In's RTI exemption may be justified for national security reasons.
- Strict safe harbour could be misused by malicious actors.
- Risk-based requirements may increase compliance burden on small organisations.
Way Forward
- Improve detection capabilities, especially in public sector, through mandatory security audits.
- Publish anonymised postmortem analyses and remediation outcomes for transparency.
- Review CERT-In's RTI exemption to balance security and accountability.