Cyber Security and Digital Public Infrastructure: Notes

The correct answer is A, the Information Technology Act, 2000. It gives legal recognition to electronic records and digital signatures, creates the offences of computer-related crime, and was amended substantially in 2008 to add provisions on cyber terrorism, interception and data protection by body corporates. Option B is wrong; the Indian Telegraph Act of 1885 governs telegraph and telephone services and the licensing of telecommunications, not computer offences. Option C is wrong because the Indian Evidence Act of 1872 deals with evidence generally, although the IT Act amended it so that electronic records could be admitted as evidence. Option D is wrong since the Companies Act of 2013 regulates companies and their governance. The IT Act was drafted on the model of the UNCITRAL Model Law on Electronic Commerce.

The correct answer is B, Confidentiality, Integrity and Availability. These are the three goals of information security: only authorised persons should read the data, the data must not be altered without authority, and the system must work when it is needed. Option A is wrong; control and access are mechanisms rather than the named goals of the triad. Option C is wrong because cryptography, identity and authentication are tools used to achieve the three goals, not the goals themselves, and this option is attractive to anyone who remembers the technical vocabulary instead of the framework. Option D is wrong since compliance, inspection and audit belong to governance and assurance work. A denial of service attack is a good illustration, because it attacks availability alone while leaving confidentiality and integrity untouched.

The correct answer is B, Shreya Singhal v. Union of India. In 2015 the Supreme Court held section 66A, which punished the sending of offensive messages through a communication service, to be unconstitutional because it was vague and overbroad and violated the freedom of speech under Article 19(1)(a). Option A is wrong, although it is the closest in subject matter: the Puttaswamy judgment of 2017 held the right to privacy to be a fundamental right under Article 21, and it led to the data protection law rather than to the striking down of 66A. Option C is wrong; Anuradha Bhasin in 2020 concerned internet shutdowns in Jammu and Kashmir. Option D is wrong because Maneka Gandhi in 1978 expanded the meaning of personal liberty under Article 21 long before the internet.

The correct answer is C, Section 70B. The Indian Computer Emergency Response Team functions under the Ministry of Electronics and Information Technology and is designated by section 70B as the national agency for collecting and analysing information on cyber incidents, issuing advisories and coordinating responses. Option A is wrong; section 69 gives the power to intercept, monitor or decrypt information in specified circumstances. Option B is the hardest distractor because section 70A designates the nodal agency for critical information infrastructure, which is the NCIIPC, a different body working under the National Technical Research Organisation. Option D is wrong since section 79 is the safe harbour provision that limits an intermediary's liability for content uploaded by third parties. Keep 70A with NCIIPC and 70B with CERT-In.

The correct answer is B, the National Technical Research Organisation. The NCIIPC was designated under section 70A of the IT Act to protect critical information infrastructure, meaning computer resources whose incapacitation would have a debilitating effect on national security, the economy, public health or safety, and it works as a unit of the NTRO. Option A is wrong; the Reserve Bank regulates the financial sector's own cyber resilience but does not house the NCIIPC. Option C is wrong, although the Ministry of Home Affairs runs the Indian Cyber Crime Coordination Centre and the national cybercrime reporting portal, which is why it is a tempting choice. Option D is wrong because the National Informatics Centre provides information technology services to government departments rather than protecting critical infrastructure.

The correct answer is B, the National Payments Corporation of India. The NPCI, set up in 2008 under the Payment and Settlement Systems Act of 2007 by the Reserve Bank and the Indian Banks' Association, launched UPI in 2016; it also runs RuPay, IMPS, the Aadhaar Enabled Payment System, NACH and FASTag. Option A is wrong but is the commonest mistake, because the Reserve Bank promoted the NPCI and regulates payment systems, yet UPI is an NPCI product. Option C is wrong; the State Bank of India is one of the banks that participate in UPI, not its owner. Option D is wrong because the Ministry of Electronics and Information Technology runs DigiLocker and the Digital India programme, not the payments layer. UPI forms the payments layer of what is called India Stack.

The correct answer is C, a distributed denial of service attack. A denial of service attack exhausts a server's capacity with a flood of requests, and when the flood is generated from many machines at once, often a botnet of infected computers, it is called distributed. The goal attacked here is availability, the third limb of the CIA triad. Option A is wrong; phishing is a fraudulent message imitating a trusted institution in order to obtain a password or card number. Option B is wrong because SQL injection inserts malicious database commands through an input field to read or alter stored data, which attacks confidentiality and integrity. Option D is wrong since a man-in-the-middle attack intercepts traffic between two parties without either of them knowing. The Cyber Swachhta Kendra exists to clean the botnets used in such attacks.

The correct answer is B, Data Principal. The Act of 2023 calls the individual to whom the personal data relates the Data Principal, and gives that person rights of access, correction, erasure and grievance redressal. Option A is wrong and is the commonest confusion: a Data Fiduciary is the person or entity that decides the purpose and means of processing the data, and it carries the duties under the Act. Option C is wrong because a Consent Manager is an entity registered with the Data Protection Board through which a Data Principal can give, manage and withdraw consent. Option D is wrong since a Data Processor processes data on behalf of a Data Fiduciary. The Act follows the Puttaswamy judgment of 2017 and the report of the Justice B. N. Srikrishna Committee.

The correct answer is A, phishing. Phishing uses a message that looks as though it comes from a trusted institution, so that the reader voluntarily gives up credentials; the same fraud carried out by telephone call is called vishing and by text message smishing. Option B is wrong; ransomware is malicious software that encrypts the victim's files and demands a payment for the key, so it does not depend on the victim disclosing a password. Option C is wrong because spoofing is the faking of an address or identifier at the technical level, and while a phishing email often spoofs a sender address, the named offence here is the deception of the reader. Option D is wrong since a zero-day exploit attacks a software flaw for which no patch yet exists, which is a technical weakness rather than a trick played on a person.

The correct answer is B, 1 July 2015. Digital India was launched on that date with three stated aims: digital infrastructure as a utility for every citizen, governance and services on demand, and the digital empowerment of citizens; BharatNet, Common Service Centres, DigiLocker and the UMANG application all sit within it. Option A is wrong; 15 August 2014 is the date of the announcement of the Jan Dhan Yojana from the Red Fort, which was launched later that month. Option C is wrong and corresponds to no launch, although the Unified Payments Interface did come in 2016. Option D is wrong because 2 October 2014 is the launch of the Swachh Bharat Mission, chosen for Gandhi's birth anniversary, which makes it a plausible date for anyone guessing from the pattern of government launches.