The Republic of India stands at a defining moment in its technological history. With a digital population exceeding 900 million and a stated national ambition to cultivate a $1 trillion digital economy by the fiscal year 2027-28 , the nation has effectively tethered its economic destiny to the stability of its digital infrastructure. Yet, as the dependency on this infrastructure deepens, the governance mechanisms designed to protect it remain dangerously fragmented, operating within an administrative architecture that was conceived in an era before ransomware-as-a-service and state-sponsored hybrid warfare became existential threats. The current cybersecurity framework is characterized by a “hub-and-spoke” model that has, in practice, devolved into a series of disconnected silos. Responsibilities are distributed across the Ministry of Electronics and Information Technology (MeitY), the Ministry of Home Affairs (MHA), the Prime Minister’s Office (PMO), and the Ministry of Defence (MoD), creating a labyrinth of jurisdictional overlaps, policy latency, and operational friction.
This comprehensive report evaluates the proposal to establish a unified administrative body—either a standalone Ministry of Cyber Security or a specialized Ministry of State—to resolve these systemic vulnerabilities. The analysis is grounded in a deep examination of the escalating threat landscape, evidenced by the fact that Indian citizens lost a staggering ₹22,845 crore to cyber fraud in 2024 alone, a 206% increase from the previous year. It explores the bureaucratic ‘turf wars’ between MeitY and MHA over control of nodal agencies like CERT-In , the persistent delay in promulgating the National Cyber Security Strategy (NCSS) , and the operational paralysis observed during major incidents like the AIIMS ransomware attack. By benchmarking India’s governance model against global pivots—specifically Australia’s appointment of a Cabinet-level Cyber Security Minister and Israel’s centralized National Cyber Directorate — this report argues that the creation of a unified political office is not merely an administrative convenience but a national security imperative.
The Strategic Imperative
The Asymmetry of Digital Ambition and Security Deficit
The narrative of India’s digital transformation is one of unprecedented scale and speed. The proliferation of the Unified Payments Interface (UPI), the digitization of public services through the India Stack, and the penetration of affordable data services have integrated the internet into the metabolic rate of the Indian economy. However, this rapid digitization has expanded the attack surface for malicious actors at a rate that defensive capabilities have struggled to match. The defining characteristic of India’s current cyber landscape is a profound asymmetry: the economic value flowing through digital channels is growing exponentially, while the security architecture protecting it improves only incrementally.
In 2024, the financial toll of this asymmetry became starkly visible. Data presented by the Ministry of Home Affairs in Parliament revealed that Indian citizens lost over ₹22,845.73 crore to cyber fraud in 2024.5 This figure represents a dramatic escalation from the ₹7,465 crore recorded in 2023 and the ₹2,290 crore in 2022. Such a geometric progression of financial loss suggests that current containment strategies are failing to keep pace with the innovation cycles of cybercriminal syndicates. The threat is no longer confined to isolated incidents of theft; it has metastasized into an industrial-scale extraction of wealth from the Indian economy, often orchestrated by transnational syndicates operating from “scam factories” in Southeast Asia.
The implications of this security deficit extend beyond immediate financial losses. The Parliamentary Standing Committee on Finance has explicitly linked the rise in cybercrime to the broader health of the financial services ecosystem. If the perception solidifies that digital platforms are inherently unsafe, the adoption of digital public infrastructure could stall, jeopardizing the $1 trillion digital economy target. The ‘trust deficit’ created by repeated breaches and unchecked fraud poses a macroeconomic risk that the current fragmented governance structure is ill-equipped to mitigate.
The Threat Matrix: From Retail Fraud to Statecraft
The threat landscape facing India is diverse, sophisticated, and aggressive. It ranges from low-level retail fraud targeting individual citizens to high-end state-sponsored espionage aimed at crippling critical national infrastructure.
The Industrialization of Cyber Fraud
At the retail level, cybercrime has evolved into a highly organized industry. “Digital arrest” scams, where fraudsters impersonate police or narcotics officials to extort money, investment fraud, and trading scams have become endemic. In the first four months of 2024 alone, trading scams drained ₹14 billion from victims.12 These operations are not the work of lone hackers but of sophisticated criminal enterprises that employ trafficked labor and leverage advanced psychological manipulation techniques. The surge in these crimes—500% between 2021 and 2024—indicates a systemic failure in deterrence and enforcement.12
The Siege on Critical Infrastructure
Beyond financial fraud, the threat to Critical Information Infrastructure (CII) has escalated. The ransomware attack on the All India Institute of Medical Sciences (AIIMS) in 2022 served as a watershed moment. The attack paralyzed a premier medical institution, disrupting patient care and exposing the sensitive data of millions of citizens, including high-profile political figures. This incident highlighted the lack of a unified command structure, as multiple agencies—including the Delhi Police, MeitY, MHA, and the National Security Council Secretariat (NSCS)—attempted to manage the crisis without a clear lead authority. The chaos that ensued underscored the operational gaps in India’s cyber defense posture, where jurisdictional ambiguity can lead to delays in mitigation and attribution.
The Shadow of State-Sponsored Espionage
Geopolitical tensions, particularly with China and Pakistan, have manifested acutely in the cyber domain. Threat intelligence reports have identified specific state-linked hacking groups targeting Indian telecommunications, power, and government sectors. Groups such as ‘Flax Typhoon’ and RedEcho’ have been linked to reconnaissance and pre-positioning activities within India’s critical infrastructure grids. The strategic objective in these campaigns is not immediate financial gain but the establishment of persistence—the ability to disrupt or degrade essential services during a future conflict. The ‘borderless’ nature of cyber warfare means that these threats bypass traditional military defenses, striking directly at the civilian and economic heart of the nation.
The Institutional Archipelago: A Governance Crisis
The current administrative framework for cybersecurity in India is often described as a “hub-and-spoke” model, but in practice, it functions more like an archipelago of isolated islands. Governance is split primarily between civilian technical agencies, law enforcement bodies, and national security institutions, each operating under different ministries and statutory mandates.
The Fragmented Mandates
The responsibility for securing India’s cyberspace is distributed among several key agencies such as CERT-In, I4C, NCIIPC, etc.
This fragmentation results in significant coordination challenges. For instance, if a bank suffers a cyberattack, it is technically an “incident” under the purview of CERT-In (MeitY), a “crime” under the jurisdiction of state police and I4C (MHA), and potentially a “critical infrastructure breach” involving NCIIPC (PMO). Each of these agencies has different reporting requirements, operational procedures, and command chains, leading to duplication of effort and confusion during crises.
The MeitY vs. MHA ‘Turf War’
One of the most debilitating aspects of the current structure is the persistent friction between MeitY and MHA. This is not merely a bureaucratic rivalry; it represents a fundamental divergence in organizational culture and strategic priority.
The Ministry of Home Affairs views cybersecurity primarily through the lens of law enforcement and internal security. With the explosion of cybercrime, MHA argues that the nodal agency, CERT-In, should be brought under its purview to enhance investigative capabilities. MHA officials contend that CERT-In’s technical expertise is essential for attributing crimes to perpetrators and that the current separation hinders “law enforcement’s ability to combat cybercrimes effectively”. They argue that the distinction between a “technical incident” and a ‘crime’ is increasingly blurred, and the lack of police powers within CERT-In creates a critical gap between detection and prosecution.
Conversely, MeitY views cybersecurity through the lens of technology governance, resilience, and economic growth. It argues that CERT-In’s primary role is incident response, patching vulnerabilities, and issuing technical directions—functions that require deep collaboration with the private sector and the global technical community. MeitY officials emphasize that CERT-In lacks search and seizure powers for a specific reason: to encourage voluntary reporting of breaches by companies without the fear of immediate punitive police action. They fear that militarizing or policing the technical response function would stifle the flow of information and harm the digital economy.
This tug-of-war has practical consequences. Reports suggest that the lack of a clear hierarchy delayed the response to the AIIMS attack, as technical responders and investigators struggled to coordinate their actions. Furthermore, the ambiguity in the Allocation of Business Rules—despite a 2024 amendment attempting to clarify roles—has failed to resolve these structural tensions.
The Governance Gap
The Policy Vacuum and Strategic Drift
The absence of a unified political authority has led to a palpable drift in national cyber policy. India’s current National Cyber Security Policy dates back to 2013. In the twelve years since its promulgation, the technological landscape has been revolutionized by the advent of 5G, artificial intelligence, cloud computing, and the proliferation of IoT devices. The 2013 policy is woefully inadequate to address the challenges of the modern threat environment.
The Missing National Cyber Security Strategy (NCSS)
Recognizing this gap, a task force headed by the National Cyber Security Coordinator was constituted in 2019 to draft a new National Cyber Security Strategy (NCSS). Despite repeated assurances from officials that the strategy was in the ‘final stages’ of approval—most notably in 2023 — the document remains unreleased as of late 2025. This delay is symptomatic of the multi-stakeholder gridlock inherent in the current system. A strategy document of this magnitude requires consensus across MeitY, MHA, MoD, the Ministry of External Affairs, and the Finance Ministry. In the absence of a single Minister with the political capital to push the document through the Cabinet Committee on Security (CCS), the strategy appears to remain stuck in an endless loop of inter-ministerial consultations.
Reactive Policymaking: The “Sanchar Saathi” Debacle
The lack of a cohesive strategy often leads to reactive, disjointed, and ill-conceived policy measures. A prime example is the recent controversy surrounding the “Sanchar Saathi” app. The government reportedly issued a confidential order mandating smartphone manufacturers to pre-install this state-run security app, citing the need to combat cyber fraud.
The proposal triggered an immediate and intense backlash from privacy activists, opposition parties, and the technology industry (including major players like Apple and Samsung), who feared that the app could act as a ‘surveillance backdoor’. Faced with this resistance, the government was forced to withdraw the mandatory order within days, diluting it to a voluntary measure. A dedicated Ministry with a clear mandate for both security and civil liberties—and a transparent policymaking process—might have stress-tested such a directive against privacy norms and industry feasibility before issuance. Instead, the fragmented approach led to a “shoot first, ask questions later” scenario that embarrassed the government and created uncertainty in the market.
The Human Capital Crisis
India faces a severe shortage of skilled cybersecurity professionals, a deficit estimated at over 1 million personnel. This talent gap is most acute in the public sector, where government salary structures and recruitment processes cannot compete with the private sector.
The Public Sector Brain Drain
The lack of skilled personnel in state police forces and central agencies leads to poor investigation quality and low conviction rates. Critical agencies like CERT-In and NCIIPC struggle to attract and retain top-tier talent, leaving them reliant on deputations or outsourced vendors. This reliance on external vendors for critical security functions introduces its own set of risks, including potential supply chain vulnerabilities.
Fragmented Skilling Initiatives
Currently, skilling initiatives are scattered across various ministries. MeitY has its own programs, the National Skill Development Corporation (NSDC) has others, and the All India Council for Technical Education (AICTE) has its own curriculum standards. There is no unified national framework for cybersecurity education or workforce development. A unified Ministry could drive the creation of a “National Cyber Service” or standardized certifications required for critical infrastructure jobs, thereby creating a clear pathway for talent development and recruitment.
The Federal Challenge: Policing a Borderless Crime
Policing is a state subject under the Indian Constitution, meaning that state governments are primarily responsible for law enforcement. However, cybercrime is inherently borderless, often spanning multiple states and international jurisdictions. This structural disconnect creates significant hurdles for effective investigation and prosecution.
The Jurisdictional Quagmire
When a victim in one state is defrauded by a perpetrator in another state using a server located in a third country, the jurisdictional complexities can paralyze the investigation. State police forces often lack the resources, technical expertise, and jurisdiction to pursue these complex, cross-border cases effectively. While the MHA’s I4C attempts to coordinate these efforts, it lacks the power to compel state police forces to act or to enforce standardized investigation protocols.
The Need for “Cooperative Federalism” in Cyber
A central Cyber Ministry would face the same constitutional hurdles regarding police powers. However, it could play a pivotal role in fostering ‘cooperative federalism’ by controlling the architecture of investigation. This would involve funding and upgrading state cyber forensic labs, standardizing evidence collection procedures, and managing a unified national crime reporting portal. A dedicated Minister would be better positioned to negotiate these federal arrangements and ensure that state forces are adequately resourced and aligned with national security objectives.
The Proposal for Unification
Deconstructing the Proposal
The proposal to create a separate Ministry of Cyber Security—or a specialized Ministry of State—addresses the core deficit of the current system: accountability. By consolidating the fragmented responsibilities under a single political authority, the government could create a unified chain of command that is responsive, accountable, and strategically coherent.
Option A: A Full Cabinet Ministry
Creating a standalone ‘Ministry of Cyber Security’ would place India on par with nations that view the digital domain as a distinct sovereign territory requiring dedicated governance.
-
Pros:
- Unified Budget: It would allow for the consolidation of the fragmented budgets of CERT-In, I4C, and NCSC, enabling strategic capital allocation. Currently, cybersecurity projects are scattered items in the MeitY and MHA budgets, often leading to sub-optimal resource utilization.25
- Statutory Weight: A full Ministry would have the legislative weight to drive the enactment of a comprehensive “Cyber Security Act,” replacing the outdated and piecemeal provisions of the IT Act, 2000.
- Single Point of Accountability: In the event of a major breach, there would be one Minister responsible to Parliament, eliminating the current game of finger-pointing between MeitY and MHA.
-
Cons:
- Bureaucratic Bloat: Establishing a new ministry is a time-consuming and expensive process that could lead to bureaucratic bloat.
- Integration Challenges: A new ministry would still need to interface with Intelligence (MHA/PMO) and Defense (MoD), potentially creating a new silo if the integration is not carefully managed.
Option B: A Ministry of State (Independent Charge)
The proposal explicitly mentions a “Ministry of State within MeitY or MHA” as an alternative. A more effective middle ground might be a Minister of State with Independent Charge (MoS IC) for Cyber Security, administratively housed within the PMO or Cabinet Secretariat, similar to the Department of Atomic Energy or the Department of Space.
-
Pros: This model avoids creating a massive new bureaucracy while giving the portfolio significant political weight. It allows the Minister to coordinate across MeitY and MHA with the authority of the PMO, bridging the gap between technical and security mandates.
-
Cons: If the MoS is housed within MeitY or MHA (as proposed in the notes), it fails to solve the inherent conflict of interest. An MoS in MeitY cannot effectively direct the Home Secretary (MHA) to align police procedures, and an MoS in MHA cannot direct the IT Secretary to alter technical standards. Independence is key to the success of this model.
Global Benchmarks: Learning from Leaders
To evaluate the viability of the proposal, it is instructive to examine how other leading nations have reorganized their cyber governance structures.
Australia: The Dedicated Minister Model
In 2022, Australia became the first G20 nation to appoint a dedicated Minister for Cyber Security, Clare O’Neil, in the Cabinet.
- Context: This move followed a series of high-profile data breaches (e.g., Optus, Medibank) that exposed the vulnerability of the Australian economy and the inadequacy of existing governance structures.
- Structure: The Minister sits in the Cabinet and oversees the cyber portfolio, distinct from the Home Affairs Minister (though O’Neil held both initially, the portfolio is distinct).
- Impact: The presence of a dedicated minister signaled a shift in political priority. It facilitated the rapid passage of the Security of Critical Infrastructure (SOCI) Act amendments, mandating reporting and risk management. It also provided a single face for accountability during national cyber crises.
- Relevance to India: The Australian model validates the proposal for a dedicated political office. It demonstrates that elevating the portfolio ensures that cybersecurity does not get prioritized lower than other pressing issues within a massive Home Ministry or IT Ministry.
Israel: The Centralized Directorate Model
Israel operates under a highly centralized model via the Israel National Cyber Directorate (INCD), which reports directly to the Prime Minister.
- Structure: The INCD combines policy-making functions (formerly the Cyber Bureau) and operational defense (formerly the National Cyber Security Authority) into a single, powerful entity. It has vast powers to direct the cyber defense of the civilian sector and critical infrastructure.
- Success Factor: The INCD successfully bridges the gap between the intelligence community (Unit 8200/Mossad) and the civilian economy. It acts as a regulator, enabler, and defender simultaneously, ensuring a unified national posture.
- Relevance to India: The INCD model resembles India’s NCSC but with significantly more statutory power and operational control. The INCD effectively functions as a “Ministry” in terms of authority and scope, even if it is administratively a Directorate.
The ‘DGCA for Cyber’ Recommendation
The Standing Committee on Finance has recommended a different but complementary approach: the establishment of a centralized “Cyber Protection Authority” analogous to the Directorate General of Civil Aviation (DGCA).
- Concept: Just as the DGCA regulates all aviation safety regardless of the airline or airport, this Authority would regulate cybersecurity across all sectors (banking, telecom, power, transport). It would set standards, conduct audits, and enforce compliance.
- Synthesis: This recommendation complements the “Ministry” proposal. A Ministry provides the political leadership and policy direction, while the “Cyber Protection Authority” provides the regulatory teeth and technical oversight. The combination of a Minister and a Regulator would create a robust governance structure capable of enforcing security standards across the economy.
The Operational Blueprint for a New Ministry
Bridging the Operational Divide
A unified ministry must operationalize the convergence of “Crime” and “Incident.” In the digital domain, the distinction between a technical breach and a criminal act is often artificial and counterproductive.
Integrating I4C and CERT-In
Currently, if a bank is hacked, CERT-In handles the technical mitigation (patching the vulnerability), while I4C and the police handle the criminal investigation (tracking the perpetrator). In reality, these are two sides of the same coin. Technical forensics is criminal evidence.
-
Proposal: A new Ministry should administratively merge CERT-In and I4C—or at least fully integrate their data flows and operational centers. This would create a “National Cyber Operations Centre” where law enforcement officers and technical experts sit side-by-side, sharing real-time intelligence and coordinating their actions. This model mirrors the UK’s National Cyber Security Centre (NCSC), which successfully brings together intelligence capabilities and civilian defense.
A Unified National Cyber Operations Centre (NCOC)
The creation of an NCOC would serve as the nerve center for India’s cyber defense. It would ingest data from CERT-In, I4C, NCIIPC, and sectoral CERTs to create a unified Common Operating Picture (COP) of the threat landscape. This would enable faster detection of threats, more effective response coordination, and better attribution of attacks to specific actors.
Budgetary Implications and the Economic Case
Current Allocations
The cybersecurity budget in India has seen increases in recent years but remains modest compared to the scale of the threat.
- 2024-25 Budget: The allocation for cybersecurity projects (including CERT-In) rose to approximately ₹759 crore to ₹1,000 crore.
- Comparison: In contrast, the US Cybersecurity and Infrastructure Security Agency (CISA) has a budget of over $3 billion (approx. ₹25,000 crore). While purchasing power parity applies, the discrepancy in scale is evident and concerning given the size of India’s digital population.
The ‘Cost of Inaction’
The ₹22,845 crore lost to fraud in 2024 dwarfs the government’s current cybersecurity spending.
-
ROI Argument: Investing ₹5,000 crore in a fully staffed Ministry, a modernized NCOC, and upgraded state cyber labs is fiscally prudent if it reduces fraud losses by even 25%. The current “penny-wise, pound-foolish” approach relies on underfunded agencies fighting well-funded adversaries, resulting in massive economic losses for citizens and businesses.
Civil Liberties, Privacy, and Accountability
The Surveillance Dilemma
The “Sanchar Saathi” withdrawal highlighted a critical tension in Indian cyber governance: the government’s desire for security often clashes with citizens’ right to privacy. Without a fully operational Data Protection Board (which is still being set up under the DPDP Act), executive orders on cybersecurity often lack sufficient checks and balances.
The Ministry as a Vehicle for Accountability
Critics might argue that a powerful Cyber Ministry could become a surveillance super-regulator. However, in a parliamentary democracy, a Minister is directly answerable to Parliament.
- Accountability: Currently, the NCSC (a bureaucrat) is not directly questioned in Question Hour. A Minister for Cyber Security would be subject to parliamentary scrutiny, requiring them to defend policies and answer for failures. This political accountability is essential for transparent governance.
- Transparency: A Ministry would be required to publish annual reports, budget outlays, and policy drafts (like the NCSS), reducing the opacity that currently shrouds India’s cyber policy.
Conclusion and Recommendations
The proposal to create a separate cyber security ministry—or at the very least, a high-powered Ministry of State with independent charge—is not merely an administrative reshuffle; it is a strategic necessity for India’s future.
The evidence presented in this report leads to the following inescapable conclusions:
- The Status Quo is Untenable: The fragmentation between MeitY and MHA has created a “grey zone” where responsibility is diffused, delaying critical strategic documents like the NCSS and hampering crisis response.
- The Threat is Existential: With ₹22,845 crore in annual fraud losses and increasing state-sponsored targeting of critical infrastructure, cybersecurity is now a tier-one national security priority that demands dedicated political leadership.
- Global Precedents Align: The Australian and Israeli models demonstrate that centralized, politically empowered leadership is the superior model for cyber governance in the 21st century.
Recommendations:
The Government of India should move to establish a Ministry of Cyber Security & Digital Trust. This entity should:
- Absorb and Integrate: Bring CERT-In (from MeitY) and I4C (from MHA) under a single administrative umbrella.
- Strategic Leadership: House the National Cyber Security Coordinator (NCSC) to ensure alignment between policy and operations.
- Regulatory Oversight: Serve as the administrative parent for the proposed “Cyber Protection Authority” (Regulator).
- Political Authority: Be headed by a Cabinet Minister or a Minister of State (Independent Charge) reporting directly to the Prime Minister, ensuring the authority to coordinate across the federal structure and civil-military lines.
Failure to unify this command structure risks leaving India’s trillion-dollar digital dream vulnerable to a single, catastrophic click.
